deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-25856
Published: 2021-02-03
Description: The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/; https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE: CVE-2020-25857
Published: 2021-02-03
Description: The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation, resulting in a stack buffer overflow which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's PSK.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/; https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE: CVE-2020-8294
Published: 2021-02-03
Description: A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/1023787; https://nextcloud.com/security/advisory/?id=NC-SA-2021-002; https://hackerone.com/reports/1023787
CVE: CVE-2021-25274
Published: 2021-02-03
Description: The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon processing of such messages, the service deserializes them in insecure manner, allowing remote arbitrary code execution as LocalSystem.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/
CVE: CVE-2021-25275
Published: 2021-02-03
Description: SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access to the filesystem can read database login details from that file, including the login name and its associated password. Then, the credentials can be used to get database owner access to the SWNetPerfMon.DB database. This gives access to the data collected by SolarWinds applications, and leads to admin access to the applications by inserting or changing authentication data stored in the Accounts table of the database.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/
CVE: CVE-2021-25276
Published: 2021-02-03
Description: In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the attacker obtains access to read or replace arbitrary files with LocalSystem privileges.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/
CVE: CVE-2019-16268
Published: 2021-02-03
Description: Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengine-remote-access-plus/; https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.html; https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengine-remote-access-plus/
CVE: CVE-2020-18723
Published: 2021-02-03
Description: Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://kailashbohara.com.np/blog/2020/07/15/mdaemon-stored-xss; http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html; https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN/
CVE: CVE-2020-18724
Published: 2021-02-03
Description: Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://kailashbohara.com.np/blog/2020/07/15/mdaemon-stored-xss; http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html; https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN/
CVE: CVE-2020-8588
Published: 2021-02-03
Description: Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the existence of data on other Storage Virtual Machines (SVMs).
CVSS Score: 3.5 (LOW)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-8589
Published: 2021-02-03
Description: Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the names of other Storage Virtual Machines (SVMs) and filenames on those SVMs.
CVSS Score: 3.5 (LOW)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-23331
Published: 2021-02-03
Description: This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.
CVSS Score: 4.4 (MEDIUM)
References: https://github.com/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613; https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUP-1065988; https://github.com/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613
CVE: CVE-2020-9388
Published: 2021-02-03
Description: CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://scomsupport.squaredup.com/hc/en-us/articles/[PII_REDACTED]533-CVE-2020-9388-API-Endpoints-are-not-protected-against-CSRF; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]38; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]18-CVE-2020-9388-API-Endpoints-are-not-protected-against-CSRF
CVE: CVE-2020-9389
Published: 2021-02-03
Description: A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames.
CVSS Score: 3.7 (LOW)
CWE: CWE-203
References: https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]58; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]38-CVE-2020-9389-Username-enumeration-possible-via-a-timing-attack; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]58
CVE: CVE-2020-9390
Published: 2021-02-03
Description: SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://scomsupport.squaredup.com/hc/en-us/articles/[PII_REDACTED]869-CVE-2020-9390-Stored-cross-site-scripting-Web-Content-and-Visio-tile-; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]58; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]58-CVE-2020-9390-Stored-cross-site-scripting
CVE: CVE-2021-26023
Published: 2021-02-03
Description: The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/products/security/; https://www.nagios.com/products/security/
CVE: CVE-2021-26024
Published: 2021-02-03
Description: The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.nagios.com/products/security/; https://www.nagios.com/products/security/
CVE: CVE-2021-3401
Published: 2021-02-04
Description: Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program, as demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. NOTE: the discoverer states "I believe that this vulnerability cannot actually be exploited."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://achow101.com/2021/02/0.18-uri-vuln; https://github.com/bitcoin/bitcoin/pull/16578; https://achow101.com/2021/02/0.18-uri-vuln
CVE: CVE-2021-20016
Published: 2021-02-04
Description: A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20016
CVE: CVE-2021-26687
Published: 2021-02-04
Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. In preloaded applications, the HostnameVerified default is mishandled. The LG ID is LVE-SMP-200029 (February 2021).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2021-26688
Published: 2021-02-04
Description: An issue was discovered on LG Wing mobile devices with Android OS 10 software. The biometric sensor has weak security properties. The LG ID is LVE-SMP-200030 (February 2021).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2021-26689
Published: 2021-02-04
Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. The USB laf gadget has a use-after-free. The LG ID is LVE-SMP-200031 (February 2021).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-13579
Published: 2021-02-04
Description: An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser perform arithmetic that may overflow which can result in an undersized heap allocation. Later when copying data from the file into this allocation, a heap-based buffer overflow will occur which can corrupt memory. These types of memory corruptions can allow for code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1190; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1190
CVE: CVE-2020-13580
Published: 2021-02-04
Description: An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser to explicitly trust a length from a particular record type and use it to write a 16-bit null relative to a buffer allocated on the stack. Due to a lack of bounds-checking on this value, this can allow an attacker to write to memory outside of the buffer and controllably corrupt memory. This can allow an attacker to earn code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1191; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1191
CVE: CVE-2020-13586
Published: 2021-02-04
Description: A memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014). A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1197; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1197
CVE: CVE-2020-14245
Published: 2021-02-04
Description: HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable user identity or consumes a significant amount of resources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086622; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086622
CVE: CVE-2020-14246
Published: 2021-02-04
Description: HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086470; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086470
CVE: CVE-2020-14247
Published: 2021-02-04
Description: HCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086469; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086469
CVE: CVE-2020-27247
Published: 2021-02-04
Description: A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0002, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1210; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1210
CVE: CVE-2020-27248
Published: 2021-02-04
Description: A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0003 and 0x0014, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1210; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1210
CVE: CVE-2020-27249
Published: 2021-02-04
Description: A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0004 and 0x0015, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1210; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1210
CVE: CVE-2020-6088
Published: 2021-02-04
Description: An exploitable denial of service vulnerability exists in the ENIP Request Path Network Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1008; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1008
CVE: CVE-2020-16194
Published: 2021-02-04
Description: An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/login-securite/CVE/blob/main/CVE-2020-16194.md; https://github.com/login-securite/CVE/blob/main/CVE-2020-16194.md
CVE: CVE-2020-28449
Published: 2021-02-04
Description: This affects all versions of package decal. The vulnerability is in the set function.
CVSS Score: 8.6 (HIGH)
References: https://github.com/gigafied/decal.js/blob/master/src/utils/set.js%23L45-L73; https://snyk.io/vuln/SNYK-JS-DECAL-1051007; https://www.npmjs.com/package/decal
CVE: CVE-2020-28450
Published: 2021-02-04
Description: This affects all versions of package decal. The vulnerability is in the extend function.
CVSS Score: 8.6 (HIGH)
References: https://github.com/gigafied/decal.js/blob/master/src/utils/extend.js%23L23-L56; https://snyk.io/vuln/SNYK-JS-DECAL-1051028; https://www.npmjs.com/package/decal
CVE: CVE-2020-27872
Published: 2021-02-04
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from improper state tracking in the password recovery process. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11365.
CVSS Score: 8.8 (HIGH)
CWE: CWE-642, CWE-668
References: https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers; https://www.zerodayinitiative.com/advisories/ZDI-21-071/; https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
CVE: CVE-2020-27873
Published: 2021-02-04
Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SOAP API endpoint, which listens on TCP port 80 by default. The issue results from the lack of proper access control. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-11559.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers; https://www.zerodayinitiative.com/advisories/ZDI-21-072/; https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
CVE: CVE-2020-4640
Published: 2021-02-04
Description: Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy servers, cdn, logging platforms, etc. An attacker can make use of this information to perform attacks by impersonating a user. IBM X-Force ID: 185510.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185510; https://www.ibm.com/support/pages/node/6410486; https://exchange.xforce.ibmcloud.com/vulnerabilities/185510
CVE: CVE-2020-4825
Published: 2021-02-04
Description: IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 189839.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189839; https://www.ibm.com/support/pages/node/6410506; https://exchange.xforce.ibmcloud.com/vulnerabilities/189839
CVE: CVE-2020-4826
Published: 2021-02-04
Description: IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 189840.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189840; https://www.ibm.com/support/pages/node/6410912; https://exchange.xforce.ibmcloud.com/vulnerabilities/189840