deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22643
Published: 2023-02-07
Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially crafted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. openSUSE Leap 15.4 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://bugzilla.suse.com/show_bug.cgi?id=1206836; https://bugzilla.suse.com/show_bug.cgi?id=1206836
CVE: CVE-2023-23696
Published: 2023-02-07
Description: 
Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locally authenticated malicious users could potentially exploit this vulnerability in order to write arbitrary files to the system.


CVSS Score: 7.0 (HIGH)
CWE: CWE-285, CWE-863
References: https://www.dell.com/support/kbdoc/en-us/000208331/dsa-2023-029-dell-command-intel-vpro-out-of-band-security-update-for-an-improper-authorization-vulnerability; https://www.dell.com/support/kbdoc/en-us/000208331/dsa-2023-029-dell-command-intel-vpro-out-of-band-security-update-for-an-improper-authorization-vulnerability
CVE: CVE-2022-21948
Published: 2023-02-07
Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript into SVG files. This issue affects: openSUSE paste paste version b57b9f87e303a3db9465776e657378e96845493b and prior versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.suse.com/show_bug.cgi?id=1197930; https://bugzilla.suse.com/show_bug.cgi?id=1197930
CVE: CVE-2015-10075
Published: 2023-02-07
Description: A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.1 is able to address this issue. The patch is named e05e0104fc42ad13b57e2b2cb2d[PII_REDACTED]d39. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220219. NOTE: This attack is not very likely.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://github.com/georgestephanis/Custom-Content-Width/commit/e05e0104fc42ad13b57e2b2cb2d[PII_REDACTED]d39; https://vuldb.com/?ctiid.220219; https://vuldb.com/?id.220219
CVE: CVE-2022-21953
Published: 2023-02-07
Description: A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
CVSS Score: 7.4 (HIGH)
CWE: CWE-862, CWE-862
References: https://bugzilla.suse.com/show_bug.cgi?id=1199731; https://bugzilla.suse.com/show_bug.cgi?id=1199731
CVE: CVE-2022-31249
Published: 2023-02-07
Description: A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://bugzilla.suse.com/show_bug.cgi?id=1200299; https://bugzilla.suse.com/show_bug.cgi?id=1200299
CVE: CVE-2022-43755
Published: 2023-02-07
Description: A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-331
References: https://bugzilla.suse.com/show_bug.cgi?id=1205297; https://bugzilla.suse.com/show_bug.cgi?id=1205297
CVE: CVE-2022-43756
Published: 2023-02-07
Description: A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-74
References: https://bugzilla.suse.com/show_bug.cgi?id=1205296; https://bugzilla.suse.com/show_bug.cgi?id=1205296
CVE: CVE-2022-43757
Published: 2023-02-07
Description: A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-312
References: https://bugzilla.suse.com/show_bug.cgi?id=1205295; https://bugzilla.suse.com/show_bug.cgi?id=1205295
CVE: CVE-2022-43758
Published: 2023-02-07
Description: A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-78
References: https://bugzilla.suse.com/show_bug.cgi?id=1205294; https://bugzilla.suse.com/show_bug.cgi?id=1205294
CVE: CVE-2022-43759
Published: 2023-02-07
Description: A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269, CWE-269
References: https://bugzilla.suse.com/show_bug.cgi?id=1205293; https://bugzilla.suse.com/show_bug.cgi?id=1205293
CVE: CVE-2023-0707
Published: 2023-02-07
Description: A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been rated as critical. Affected by this issue is the function delete_record of the file function.php. The manipulation of the argument id leads to sql injection. VDB-220346 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.220346; https://vuldb.com/?id.220346; https://vuldb.com/?ctiid.220346
CVE: CVE-2021-37491
Published: 2023-02-07
Description: An issue discovered in src/wallet/wallet.cpp in Dogecoin Project Dogecoin Core 1.14.3 and earlier allows attackers to view sensitive information via CWallet::CreateTransaction() function.
CVSS Score: 7.5 (HIGH)
References: http://dogecoin.com; https://github.com/VPRLab/BlkVulnReport/blob/main/NDSS23_BlockScope.pdf; https://github.com/bitcoin/bitcoin/commit/2fb9c1e[PII_REDACTED]e24a19172ed6d78d95d50d3
CVE: CVE-2022-45544
Published: 2023-02-07
Description: Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as a theme that was obtained from a trusted source or was developed for their own website. Only an admin can upload such code, not someone else in an "attacker" role.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://blog.tristaomarinho.com/schlix-cms-2-2-7-2-arbitrary-file-upload/; https://github.com/tristao-marinho/CVE-2022-45544/blob/main/README.md; https://www.schlix.com/
CVE: CVE-2022-46620
Published: 2023-02-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-46621
Published: 2023-02-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2011-10002
Published: 2023-02-07
Description: A vulnerability classified as critical has been found in weblabyrinth 0.3.1. This affects the function Labyrinth of the file labyrinth.inc.php. The manipulation leads to sql injection. Upgrading to version 0.3.2 is able to address this issue. The identifier of the patch is 60793fd8c8c4759596d3510641e96ea40e7f60e9. It is recommended to upgrade the affected component. The identifier VDB-220221 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://code.google.com/archive/p/weblabyrinth/issues/1; https://github.com/rotelok/weblabyrinth/commit/60793fd8c8c4759596d3510641e96ea40e7f60e9; https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/weblabyrinth/weblabyrinth-0.3.2.tar.gz
CVE: CVE-2022-40224
Published: 2023-02-07
Description: A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP message header can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-410
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1618; https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1618
CVE: CVE-2022-40691
Published: 2023-02-07
Description: An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1621; https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1621
CVE: CVE-2022-40693
Published: 2023-02-07
Description: A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1616; https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1616
CVE: CVE-2022-41311
Published: 2023-02-07
Description: A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="webLocationMessage_text" name="webLocationMessage_text"
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619; https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619
CVE: CVE-2022-41312
Published: 2023-02-07
Description: A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="Switch Description", name "switch_description"
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619; https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619
CVE: CVE-2022-41313
Published: 2023-02-07
Description: A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="switch_contact"
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619; https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619
CVE: CVE-2022-24990
Published: 2023-02-07
Description: TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html; https://forum.terra-master.com/en/viewforum.php?f=28; https://github.com/0xf4n9x/CVE-2022-24990
CVE: CVE-2022-46285
Published: 2023-02-07
Description: A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2023/10/03/1; http://www.openwall.com/lists/oss-security/2023/10/03/10; https://bugzilla.redhat.com/show_bug.cgi?id=2160092
CVE: CVE-2022-4883
Published: 2023-02-07
Description: A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-426
References: https://bugzilla.redhat.com/show_bug.cgi?id=2160213; https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/515294bb8023a45ff91669; https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
CVE: CVE-2023-22735
Published: 2023-02-07
Description: Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitrary `Content-Type` which would be served from the Zulip hostname with `Content-Disposition: inline` and no `Content-Security-Policy` header, allowing them to trick other users into executing arbitrary Javascript in the context of the Zulip application.  Among other things, this enables session theft. Only deployments which use the S3 storage (not the local-disk storage) are affected, and only deployments which deployed commit 04cf68b45ebb5c03247a0d6453e35ffc175d55da, which has only been in `main`, not any numbered release. Users affected should upgrade from main again to deploy this fix. Switching from S3 storage to the local-disk storage would nominally mitigate this, but is likely more involved than upgrading to the latest `main` which addresses the issue.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-436
References: https://github.com/zulip/zulip/commit/04cf68b45ebb5c03247a0d6453e35ffc175d55da; https://github.com/zulip/zulip/commit/2f6c5a883e106aa82a570d3d1f243993284b70f3; https://github.com/zulip/zulip/security/advisories/GHSA-wm83-3764-5wqh
CVE: CVE-2023-24813
Published: 2023-02-07
Description: Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of `image` tags and respects `xlink:href` even if `href` is specified. However, php-svg-lib, which is later used to parse the svg file, parses the href attribute. Since `href` is respected if both `xlink:href` and `href` is specified, it's possible to bypass the protection on the Dompdf side by providing an empty `xlink:href` attribute. An attacker can exploit the vulnerability to call arbitrary URLs with arbitrary protocols if they provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, which will lead, at the very least, to arbitrary file deletion and might lead to remote code execution, depending on available classes. This vulnerability has been addressed in commit `95009ea98` which has been included in release version 2.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-436
References: https://github.com/dompdf/dompdf/commit/95009ea98230f9b084b040c34e3869ef3dccc9aa; https://github.com/dompdf/dompdf/security/advisories/GHSA-56gj-mvh6-rp75; https://github.com/dompdf/dompdf/commit/95009ea98230f9b084b040c34e3869ef3dccc9aa
CVE: CVE-2023-24814
Published: 2023-02-07
Description: TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject malicious HTML code to pages that have not been rendered and cached, yet. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of `GeneralUtility::getIndpEnv('SCRIPT_NAME')` and corresponding usages (as shown below) are vulnerable as well. Additional investigations confirmed that at least Apache web server deployments using CGI (FPM, FCGI/FastCGI, and similar) are affected. However, there still might be the risk that other scenarios like nginx, IIS, or Apache/mod_php are vulnerable. The usage of server environment variable `PATH_INFO` has been removed from corresponding processings in `GeneralUtility::getIndpEnv()`. Besides that, the public property `TypoScriptFrontendController::$absRefPrefix` is encoded for both being used as a URI component and for being used as a prefix in an HTML context. This mitigates the cross-site scripting vulnerability. Users are advised to update to TYPO3 versions 8.7.51 ELTS, 9.5.40 ELTS, 10.4.35 LTS, 11.5.23 LTS and 12.2.0 which fix this problem. For users who are unable to patch in a timely manner the TypoScript setting `config.absRefPrefix` should at least be set to a static path value, instead of using auto - e.g. `config.absRefPrefix=/`. This workaround **does not fix all aspects of the vulnerability**, and is just considered to be an intermediate mitigation to the most prominent manifestation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Setup/Config/Index.html#absrefprefix; https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/core/Classes/Utility/GeneralUtility.php#L2481-L2484; https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php#L2547-L2549
CVE: CVE-2022-47412
Published: 2023-02-07
Description: Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#733; https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/; https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#733
CVE: CVE-2023-0732
Published: 2023-02-07
Description: A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is the function registration of the file oews/classes/Users.php of the component POST Request Handler. The manipulation of the argument firstname/middlename/lastname/email/contact leads to cross site scripting. The attack can be launched remotely. The identifier VDB-220369 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.220369; https://vuldb.com/?id.220369; https://vuldb.com/?ctiid.220369
CVE: CVE-2023-25194
Published: 2023-02-07
Description: A possible security vulnerability has been identified in Apache Kafka Connect API.
This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config
and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.
When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`
property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the
`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.
This will allow the server to connect to the attacker's LDAP server
and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.
Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box
configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector
client override policy that permits them.

Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage
in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0. 

We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for 
vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,
in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector
client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.

CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.html; https://kafka.apache.org/cve-list; https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz