deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23479
Published: 2024-02-15
Description: SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-22
References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-23479; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-23479
CVE: CVE-2024-25123
Published: 2024-02-15
Description: MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The `filename` variable is joined with other variables to form a file path in `_file`. However, `filename` is a route parameter that can capture path type values i.e. values including slashes (\). So it is possible for an attacker to manipulate the file being read by assigning a value containing ../ to `filename` and so the attacker may be able to gain access to other files on the host filesystem. This issue has been addressed in MSS version 8.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/Open-MSS/MSS/commit/f23033729ee930b97f8bdbd07df0174311c9b658; https://github.com/Open-MSS/MSS/security/advisories/GHSA-pf2h-qjcr-qvq2; https://github.com/Open-MSS/MSS/commit/f23033729ee930b97f8bdbd07df0174311c9b658
CVE: CVE-2023-40100
Published: 2024-02-15
Description: In discovery_thread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://android.googlesource.com/platform/packages/modules/DnsResolver/+/8e1561fb603fdaec15798372f865fb1750537f4f; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/packages/modules/DnsResolver/+/8e1561fb603fdaec15798372f865fb1750537f4f
CVE: CVE-2023-40104
Published: 2024-02-15
Description: In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://android.googlesource.com/platform/system/ca-certificates/+/91204b9fdbd77b3f27f94b73868607b2dccbfdad; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/system/ca-certificates/+/91204b9fdbd77b3f27f94b73868607b2dccbfdad
CVE: CVE-2023-40105
Published: 2024-02-15
Description: In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://android.googlesource.com/platform/frameworks/base/+/935eb5ed6be35860a99ea242fb753f687d54a308; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/frameworks/base/+/935eb5ed6be35860a99ea242fb753f687d54a308
CVE: CVE-2023-40106
Published: 2024-02-15
Description: In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://android.googlesource.com/platform/frameworks/base/+/442b4390c1f04b0e74ae4a7e349418dad4e7522e; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/frameworks/base/+/442b4390c1f04b0e74ae4a7e349418dad4e7522e
CVE: CVE-2023-40107
Published: 2024-02-15
Description: In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://android.googlesource.com/platform/frameworks/av/+/acb81624b4f50fed52cb1b3829809ee2f7377093; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/frameworks/av/+/acb81624b4f50fed52cb1b3829809ee2f7377093
CVE: CVE-2023-40109
Published: 2024-02-15
Description: In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: https://android.googlesource.com/platform/frameworks/base/+/387d258cf10a30537fc48dc0e48d28071efa92e7; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/frameworks/base/+/387d258cf10a30537fc48dc0e48d28071efa92e7
CVE: CVE-2023-40110
Published: 2024-02-15
Description: In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://android.googlesource.com/platform/frameworks/av/+/53243faf690a49e00952b3d3956d2fff0b8d4a3c; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/frameworks/av/+/53243faf690a49e00952b3d3956d2fff0b8d4a3c
CVE: CVE-2023-40111
Published: 2024-02-15
Description: In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-441
References: https://android.googlesource.com/platform/frameworks/base/+/55d3d57cbffc838c52d610af14a056dea87b422e; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/frameworks/base/+/55d3d57cbffc838c52d610af14a056dea87b422e
CVE: CVE-2023-40112
Published: 2024-02-15
Description: In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of past print jobs or other print-related information, with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d7cb53cb5b47f4afdb84cb0e161d84fdc2c32ce7; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d7cb53cb5b47f4afdb84cb0e161d84fdc2c32ce7
CVE: CVE-2023-40113
Published: 2024-02-15
Description: In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/64ca6ba981745875dbf2064e0b2a47f8194c4f0a; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/64ca6ba981745875dbf2064e0b2a47f8194c4f0a
CVE: CVE-2023-40114
Published: 2024-02-15
Description: In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://android.googlesource.com/platform/frameworks/av/+/2fdf54b050f728fd965c9afdd03116e9b9dafbae; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/frameworks/av/+/2fdf54b050f728fd965c9afdd03116e9b9dafbae
CVE: CVE-2023-40115
Published: 2024-02-15
Description: In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://android.googlesource.com/platform/packages/modules/StatsD/+/e4cd2d8f75d1b7b83a759d752f38099a9aa9997e; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/packages/modules/StatsD/+/e4cd2d8f75d1b7b83a759d752f38099a9aa9997e
CVE: CVE-2023-40124
Published: 2024-02-15
Description: In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead to local information disclosure of photos or other images with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://android.googlesource.com/platform/frameworks/base/+/86c8421c1181816b6cb333eb62a78e32290c4b17; https://source.android.com/security/bulletin/2023-11-01; https://android.googlesource.com/platform/frameworks/base/+/86c8421c1181816b6cb333eb62a78e32290c4b17
CVE: CVE-2024-23674
Published: 2024-02-15
Description: The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle attacker can assume a victim's identify for access to government, medical, and financial resources, and can also extract personal data from the card, aka the "sPACE (Spoofing Password Authenticated Connection Establishment)" issue. This occurs because of a combination of factors, such as insecure PIN entry (for basic readers) and eid:// deeplinking. The victim must be using a modified eID kernel, which may occur if the victim is tricked into installing a fake version of an official app. NOTE: the BSI position is "ensuring a secure operational environment at the client side is an obligation of the ID card owner."
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-290
References: https://ctrlalt.medium.com/space-attack-spoofing-eids-password-authenticated-connection-establishment-11561e5657b1; https://www.ausweisapp.bund.de/; https://www.dropbox.com/scl/fi/2powlii0dnmr7p7v5ijhc/2024_German_eID_02_Spoofing_PACE_final.pdf?rlkey=nx0ffmmbq3hffgxsuqwf0f45z&dl=0
CVE: CVE-2023-40093
Published: 2024-02-16
Description: In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://android.googlesource.com/platform/cts/+/a952c93009cc81c41a086d73a4030a83b7683a04; https://android.googlesource.com/platform/external/pdfium/+/03925281cf25fec70318bf2225356d022b12b566; https://source.android.com/security/bulletin/2024-02-01
CVE: CVE-2023-40122
Published: 2024-02-16
Description: In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 3.3 (LOW)
References: https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931
CVE: CVE-2024-0014
Published: 2024-02-16
Description: In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://source.android.com/security/bulletin/2024-02-01; https://source.android.com/security/bulletin/2024-02-01
CVE: CVE-2024-0029
Published: 2024-02-16
Description: In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://android.googlesource.com/platform/frameworks/base/+/9b10fd9718f4e6f6843adbfc14e46a93aab93aad; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/base/+/9b10fd9718f4e6f6843adbfc14e46a93aab93aad
CVE: CVE-2024-0030
Published: 2024-02-16
Description: In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57b823f4f758e2ef530909da07552b5aa80c6a7d; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57b823f4f758e2ef530909da07552b5aa80c6a7d
CVE: CVE-2024-0031
Published: 2024-02-16
Description: In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-20
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/de53890aaca2ae08b3ee2d6e3fd25f702fdfa661; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/de53890aaca2ae08b3ee2d6e3fd25f702fdfa661
CVE: CVE-2024-0032
Published: 2024-02-16
Description: In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://android.googlesource.com/platform/frameworks/base/+/a6321142ea43053ea8d0db516eede4c35c5dab18; https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/b2cc552f8e1ed982e6662f64baa2cdbf1acaf777; https://source.android.com/security/bulletin/2025-03-01
CVE: CVE-2024-0033
Published: 2024-02-16
Description: In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://android.googlesource.com/platform/frameworks/native/+/aa98edf0ce9dde[PII_REDACTED]a459900ca987f193; https://android.googlesource.com/platform/system/core/+/46d46dc46446f14f26fbe8fb102dd36c1dfc1229; https://source.android.com/security/bulletin/2024-02-01
CVE: CVE-2024-0034
Published: 2024-02-16
Description: In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://android.googlesource.com/platform/frameworks/base/+/653f7b0d234693309dc86161af01831b64033fe6; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/base/+/653f7b0d234693309dc86161af01831b64033fe6
CVE: CVE-2024-0035
Published: 2024-02-16
Description: In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476, CWE-476
References: https://android.googlesource.com/platform/frameworks/base/+/7b7fff1eb5014d12200a32ff9047da396c7ab6a4; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/base/+/7b7fff1eb5014d12200a32ff9047da396c7ab6a4
CVE: CVE-2024-0036
Published: 2024-02-16
Description: In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://android.googlesource.com/platform/frameworks/base/+/3eaaa9687e90c65f51762deb343f18bef95d4e8e; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/base/+/3eaaa9687e90c65f51762deb343f18bef95d4e8e
CVE: CVE-2024-0037
Published: 2024-02-16
Description: In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 3.3 (LOW)
CWE: CWE-862, CWE-862, CWE-922
References: https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931
CVE: CVE-2024-0038
Published: 2024-02-16
Description: In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079
CVE: CVE-2024-0040
Published: 2024-02-16
Description: In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-122
References: https://android.googlesource.com/platform/frameworks/av/+/2ca6c27dc0336fd98f47cfb96dc514efa98e8864; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/av/+/2ca6c27dc0336fd98f47cfb96dc514efa98e8864
CVE: CVE-2024-0041
Published: 2024-02-16
Description: In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://android.googlesource.com/platform/frameworks/base/+/d6f[PII_REDACTED]c8f5ad5fc7d3eea5b1751439e26; https://source.android.com/security/bulletin/2024-02-01; https://android.googlesource.com/platform/frameworks/base/+/d6f[PII_REDACTED]c8f5ad5fc7d3eea5b1751439e26
CVE: CVE-2024-25413
Published: 2024-02-16
Description: A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-91, CWE-91
References: https://github.com/capture0x/Magento-ver.-2.4.6; https://packetstormsecurity.com/files/175801/FireBear-Improved-Import-And-Export-3.8.6-XSLT-Server-Side-Injection.html; https://github.com/capture0x/Magento-ver.-2.4.6
CVE: CVE-2024-25414
Published: 2024-02-16
Description: An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/capture0x/CSZ_CMS; https://packetstormsecurity.com/files/175889/CSZ-CMS-1.3.0-Shell-Upload.html; https://github.com/capture0x/CSZ_CMS
CVE: CVE-2024-25415
Published: 2024-02-16
Description: A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/capture0x/Phoenix; https://packetstormsecurity.com/files/175913/CE-Phoenix-1.0.8.20-Remote-Command-Execution.html; https://vulners.com/zdt/1337DAY-ID-39172
CVE: CVE-2023-6451
Published: 2024-02-16
Description: Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms.

CVSS Score: 8.6 (HIGH)
CWE: CWE-1394, CWE-287
References: https://www.themissinglink.com.au/security-advisories/cve-2023-6451; https://www.themissinglink.com.au/security-advisories/cve-2023-6451
CVE: CVE-2023-49508
Published: 2024-02-16
Description: Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/YetiForceCompany/YetiForceCRM/commit/ba3a348aa6ecdf0a1d8b289cbb679bebcda7a132; https://github.com/c4v4r0n/Research/tree/main/CVE-2023-49508; https://huntr.com/bounties/29ed641d-eb03-4532-aed4-f96e11f78983/
CVE: CVE-2023-51931
Published: 2024-02-16
Description: An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-20
References: https://gist.github.com/6en6ar/c792d8337b63f095cbda907e834cb4ba; https://github.com/alanclarke/urlite/issues/61; https://gist.github.com/6en6ar/c792d8337b63f095cbda907e834cb4ba
CVE: CVE-2024-22854
Published: 2024-02-16
Description: DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has been identified. A URL, crafted by a remote attacker and visited by an authenticated user, allows open redirect and potential credential stealing using an injected HTML form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-601, CWE-601
References: https://tomekwasiak.pl/cve-2024-22854/; https://tomekwasiak.pl/cve-2024-22854/