deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7335
Published: 2019-02-04
Description: Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'Log Message' value on the web page without applying any proper filtration. This relates to the view=logs value.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2453; https://github.com/ZoneMinder/zoneminder/issues/2453
CVE: CVE-2019-7336
Published: 2019-02-04
Description: Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2457; https://github.com/ZoneMinder/zoneminder/issues/2457
CVE: CVE-2019-7337
Published: 2019-02-04
Description: Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2456; https://github.com/ZoneMinder/zoneminder/issues/2456
CVE: CVE-2019-7338
Published: 2019-02-04
Description: Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'group' as it insecurely prints the 'Group Name' value on the web page without applying any proper filtration.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2454; https://github.com/ZoneMinder/zoneminder/issues/2454
CVE: CVE-2019-7339
Published: 2019-02-04
Description: POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'level' parameter value in the view log (log.php) because proper filtration is omitted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2460; https://github.com/ZoneMinder/zoneminder/issues/2460
CVE: CVE-2019-7340
Published: 2019-02-04
Description: POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[Query][terms][0][val]' parameter value in the view filter (filter.php) because proper filtration is omitted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2462; https://github.com/ZoneMinder/zoneminder/issues/2462
CVE: CVE-2019-7341
Published: 2019-02-04
Description: Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[LinkedMonitors]' parameter value in the view monitor (monitor.php) because proper filtration is omitted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2463; https://github.com/ZoneMinder/zoneminder/issues/2463
CVE: CVE-2019-7342
Published: 2019-02-04
Description: POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[AutoExecuteCmd]' parameter value in the view filter (filter.php) because proper filtration is omitted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2461; https://github.com/ZoneMinder/zoneminder/issues/2461
CVE: CVE-2019-7343
Published: 2019-02-04
Description: Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[Method]' parameter value in the view monitor (monitor.php) because proper filtration is omitted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2464; https://github.com/ZoneMinder/zoneminder/issues/2464
CVE: CVE-2019-7344
Published: 2019-02-04
Description: Reflected XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'filter' as it insecurely prints the 'filter[Name]' (aka Filter name) value on the web page without applying any proper filtration.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2455; https://github.com/ZoneMinder/zoneminder/issues/2455
CVE: CVE-2019-7345
Published: 2019-02-04
Description: Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, HOME_URL, HOME_CONTENT, or WEB_CONSOLE_BANNER value, allowing an attacker to execute HTML or JavaScript code. This relates to functions.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2468; https://github.com/ZoneMinder/zoneminder/issues/2468
CVE: CVE-2019-7346
Published: 2019-02-04
Description: A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the failed request, making the CSRF attack successful.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ZoneMinder/zoneminder/issues/2469; https://github.com/ZoneMinder/zoneminder/issues/2469
CVE: CVE-2019-7347
Published: 2019-02-04
Description: A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records (add/delete Monitors, Users, etc.).
CVSS Score: 7.5 (HIGH)
CWE: CWE-367
References: https://github.com/ZoneMinder/zoneminder/issues/2476; https://github.com/ZoneMinder/zoneminder/issues/2476
CVE: CVE-2019-7348
Published: 2019-02-04
Description: Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user (user.php) because proper filtration is omitted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2467; https://github.com/ZoneMinder/zoneminder/issues/2467
CVE: CVE-2019-7349
Published: 2019-02-04
Description: Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[V4LCapturesPerFrame]' parameter value in the view monitor (monitor.php) because proper filtration is omitted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2465; https://github.com/ZoneMinder/zoneminder/issues/2465
CVE: CVE-2019-7350
Published: 2019-02-04
Description: Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
CVSS Score: 7.3 (HIGH)
CWE: CWE-384
References: https://github.com/ZoneMinder/zoneminder/issues/2471; https://github.com/ZoneMinder/zoneminder/issues/2471
CVE: CVE-2019-7351
Published: 2019-02-04
Description: Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/ZoneMinder/zoneminder/issues/2466; https://github.com/ZoneMinder/zoneminder/issues/2466
CVE: CVE-2019-7352
Published: 2019-02-04
Description: Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the value supplied to the 'New State' (aka newState) field, allowing an attacker to execute HTML or JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/issues/2475; https://github.com/ZoneMinder/zoneminder/issues/2475
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=calendar&format=raw&cat[0]=SQLi&task=events". This attack appears to be exploitable if the attacker can reach the web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/140141/Joomla-DT-Register-SQL-Injection.html; https://packetstormsecurity.com/files/140141/Joomla-DT-Register-SQL-Injection.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This vulnerability appears to have been fixed in 3.x.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.kvakil.me/posts/cvsweb/; https://www.kvakil.me/posts/cvsweb/
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: [CVE-2018-20323]. Reason: This candidate is a duplicate of [CVE-2018-20323]. Notes: All CVE users should reference [CVE-2018-20323] instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-1675
Published: 2019-02-04
Description: IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10742403; https://exchange.xforce.ibmcloud.com/vulnerabilities/145110; http://www.ibm.com/support/docview.wss?uid=ibm10742403
CVE: CVE-2018-1801
Published: 2019-02-04
Description: IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to consume memory resources. IBM X-Force ID: 149639.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=ibm10795780; https://exchange.xforce.ibmcloud.com/vulnerabilities/149639; http://www.ibm.com/support/docview.wss?uid=ibm10795780
CVE: CVE-2018-1962
Published: 2019-02-04
Description: IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-384
References: http://www.ibm.com/support/docview.wss?uid=ibm10796380; http://www.securityfocus.com/bid/106854; https://exchange.xforce.ibmcloud.com/vulnerabilities/153658
CVE: CVE-2018-1970
Published: 2019-02-04
Description: IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 153751.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=ibm10796380; https://exchange.xforce.ibmcloud.com/vulnerabilities/153751; http://www.ibm.com/support/docview.wss?uid=ibm10796380
CVE: CVE-2018-20752
Published: 2019-02-04
Description: An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically, when a Twitter user possesses an Excel macro for a username, it will not be properly sanitized when exported to a CSV file. This can result in remote code execution for the attacker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://bitbucket.org/LaNMaSteR53/recon-ng/commits/41e96fd[PII_REDACTED]4fb0c920b349f8926c71d4c#chg-modules/reporting/csv.py; https://bitbucket.org/LaNMaSteR53/recon-ng/issues/285/csv-injection-vulnerability-identified-in; https://bitbucket.org/LaNMaSteR53/recon-ng/commits/41e96fd[PII_REDACTED]4fb0c920b349f8926c71d4c#chg-modules/reporting/csv.py
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role assignment and can lead to shared password leakage.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/nilsteampassnet/TeamPass/issues/2495; https://github.com/nilsteampassnet/TeamPass/issues/2495
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/go-gitea/gitea/pull/5631; https://github.com/go-gitea/gitea/pull/5631
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be logged in to WordPress as an admin, and click a link. This vulnerability appears to have been fixed in 3.3.0 and later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://advisories.dxw.com/advisories/csrf-mapsvg-lite/; https://wpvulndb.com/vulnerabilities/9198; https://advisories.dxw.com/advisories/csrf-mapsvg-lite/
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting (XSS) vulnerability in sidebar and table data that can result in Database fields aren't properly sanitized and allow code injection (Cross-Site Scripting). This attack appears to be exploitable via the payload needs to be stored in the database and the victim must see the db value in question.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yugandhargangu/JspMyAdmin2/issues/22; https://github.com/yugandhargangu/JspMyAdmin2/issues/22
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim server and trigger generation of pdf file with content <img src="phar://path/to/crafted/image">. This vulnerability appears to have been fixed in 7.1.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/mpdf/mpdf/issues/949; https://github.com/mpdf/mpdf/issues/949
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/RIOT-OS/RIOT/issues/10739; https://github.com/RIOT-OS/RIOT/issues/10739
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3.
CVSS Score: 7.4 (HIGH)
References: https://github.com/horazont/aioxmpp/pull/268; https://github.com/horazont/aioxmpp/pull/268
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://helm.sh/blog/helm-security-notice-2019/index.html; https://helm.sh/blog/helm-security-notice-2019/index.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HTTP API to save charts that can result in a specially crafted chart could be uploaded and saved outside the intended location. This attack appears to be exploitable via A POST request to the HTTP API can save a chart archive outside of the intended directory. If authentication is, optionally, enabled this requires an authorized user to do so. This vulnerability appears to have been fixed in 0.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://helm.sh/blog/chartmuseum-security-notice-2019/index.html; https://helm.sh/blog/chartmuseum-security-notice-2019/index.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpipam/phpipam/commit/fd37bd8fb2b9c306079db505e0e3fe79a096c31c; https://github.com/phpipam/phpipam/issues/2327; https://github.com/phpipam/phpipam/commit/fd37bd8fb2b9c306079db505e0e3fe79a096c31c
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/api-platform/core/issues/2364; https://github.com/api-platform/core/pull/2441; https://github.com/api-platform/core/issues/2364
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://github.com/hexpm/hex/pull/646; https://github.com/hexpm/hex/pull/651; https://github.com/hexpm/hex/pull/646
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://github.com/hexpm/hex_core/pull/48; https://github.com/hexpm/hex_core/pull/51; https://github.com/hexpm/hex_core/pull/48
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.
CVSS Score: 8.8 (HIGH)
References: https://github.com/erlang/rebar3/pull/1986; https://github.com/erlang/rebar3/pull/1986
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03; https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-04
Description: FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-129
References: https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e[PII_REDACTED]4d67f484f3ffceef3f; https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e[PII_REDACTED]4d67f484f3ffceef3f