deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-0752
Published: 2024-01-23
Description: A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable crash. This vulnerability affects Firefox < 122.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1866840; https://www.mozilla.org/security/advisories/mfsa2024-01/; https://bugzilla.mozilla.org/show_bug.cgi?id=1866840
CVE: CVE-2024-0753
Published: 2024-01-23
Description: In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1870262; https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html; https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
CVE: CVE-2024-0754
Published: 2024-01-23
Description: Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1871605; https://www.mozilla.org/security/advisories/mfsa2024-01/; https://bugzilla.mozilla.org/show_bug.cgi?id=1871605
CVE: CVE-2024-0755
Published: 2024-01-23
Description: Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1868456%2C1871445%2C1873701; https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html; https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
CVE: CVE-2023-49657
Published: 2024-01-23
Description: A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.

For 2.X versions, users should change their config to include:

TALISMAN_CONFIG = {
    "content_security_policy": {
        "base-uri": ["'self'"],
        "default-src": ["'self'"],
        "img-src": ["'self'", "blob:", "data:"],
        "worker-src": ["'self'", "blob:"],
        "connect-src": [
            "'self'",
            " https://api.mapbox.com" https://api.mapbox.com" ;,
            " https://events.mapbox.com" https://events.mapbox.com" ;,
        ],
        "object-src": "'none'",
        "style-src": [
            "'self'",
            "'unsafe-inline'",
        ],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
    "session_cookie_secure": False,
}


CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx; https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx
CVE: CVE-2024-22660
Published: 2024-01-23
Description: TOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfg
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Covteam/iot_vuln/tree/main/setLanguageCfg; https://github.com/Covteam/iot_vuln/tree/main/setLanguageCfg
CVE: CVE-2024-22662
Published: 2024-01-23
Description: TOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRules
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Covteam/iot_vuln/tree/main/setParentalRules; https://github.com/Covteam/iot_vuln/tree/main/setParentalRules
CVE: CVE-2024-22663
Published: 2024-01-23
Description: TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Covteam/iot_vuln/tree/main/setOpModeCfg2; https://github.com/Covteam/iot_vuln/tree/main/setOpModeCfg2
CVE: CVE-2024-23854
Published: 2024-01-23
Description: Rejected reason: This CVE ID was unused by the CNA.
CVE: CVE-2023-50274
Published: 2024-01-23
Description: HPE OneView may allow command injection with local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us
CVE: CVE-2023-50275
Published: 2024-01-23
Description: HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us
CVE: CVE-2024-22490
Published: 2024-01-23
Description: Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/cui2shark/security/blob/main/beetl-bbs%20-%20A%20reflected%20cross-site%20scripting%20%28XSS%29%20vulnerability%20was%20discovered%20in%20the%20search%20box.md; https://github.com/cui2shark/security/blob/main/beetl-bbs%20-%20A%20reflected%20cross-site%20scripting%20%28XSS%29%20vulnerability%20was%20discovered%20in%20the%20search%20box.md
CVE: CVE-2024-22496
Published: 2024-01-23
Description: Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/cui2shark/security/blob/main/%28JFinalcms%20admin-login-username%29%20.md; https://github.com/cui2shark/security/blob/main/%28JFinalcms%20admin-login-username%29%20.md
CVE: CVE-2023-45889
Published: 2024-01-23
Description: A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScript into any webpage. NOTE: this issue exists because of an incomplete fix for CVE-2022-48612.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.zerdle.net/classlink/; https://blog.zerdle.net/classlink2/; https://blog.zerdle.net/classlink/
CVE: CVE-2023-6573
Published: 2024-01-23
Description: HPE OneView may have a missing passphrase during restore.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us
CVE: CVE-2024-22203
Published: 2024-01-23
Description: Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request on lines 339-343 in `request.py`, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343; https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L465-L490; https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L466
CVE: CVE-2024-22204
Published: 2024-01-23
Description: Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The `config` function in `app/routes.py` does not validate the user-controlled `name` variable on line 447 and `config_data` variable on line 437. The `name` variable is insecurely concatenated in `os.path.join`, leading to path manipulation. The POST data from the `config_data` variable is saved with `pickle.dump` which leads to a limited file write. However, the data that is saved is earlier transformed into a dictionary and the `url` key value pair is added before the file is saved on the system. All in all, the issue allows us to save and overwrite files on the system that the application has permissions to, with a dictionary containing arbitrary data and the `url` key value, which is a limited file write. Version 0.8.4 contains a patch for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L419-L452; https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L437; https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L444
CVE: CVE-2024-22205
Published: 2024-01-23
Description: Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` method which sends a `GET` request on lines 339-343 in `request.py,` which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343; https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479; https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L496-L557
CVE: CVE-2024-22417
Published: 2024-01-23
Description: Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a `GET` request on lines 339-343 in `requests.py`. The returned contents of the URL are then passed to and reflected back to the user in the `send_file` function on line 484, together with the user-controlled `src_type`, which allows the attacker to control the HTTP response content type leading to a cross-site scripting vulnerability. An attacker could craft a special URL to point to a malicious website and send the link to a victim. The fact that the link would contain a trusted domain (e.g. from one of public Whoogle instances) could be used to trick the user into clicking the link. The malicious website could, for example, be a copy of a real website, meant to steal a person’s credentials to the website, or trick that person in another way. Version 0.8.4 contains a patch for this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343; https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L465-L490; https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L466
CVE: CVE-2024-23330
Published: 2024-01-23
Description: Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be loaded by default only after confirmation by the user. However, it could be recognized that certain embedded images (see PoC) are loaded, even though the "Automatic Reloading of Images" function is disabled by default. The reloading is also done unencrypted via HTTP and redirections are followed. This behavior is unexpected for the user, since the user assumes that external content will only be loaded after explicit manual confirmation. The loading of external content in e-mails represents a risk, because this makes the sender aware that the e-mail address is used, when the e-mail was read, which device is used and expose the user's IP address. Version 119.10 contains a patch for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/tutao/tutanota/security/advisories/GHSA-32w8-v5fc-vpp7; https://github.com/tutao/tutanota/security/advisories/GHSA-32w8-v5fc-vpp7
CVE: CVE-2024-23341
Published: 2024-01-23
Description: TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/i3thuan5/TuiTse-TsuSin/commit/9d21d99d7cfcd7c42aade251fab98ec102e730ea; https://github.com/i3thuan5/TuiTse-TsuSin/pull/22; https://github.com/i3thuan5/TuiTse-TsuSin/security/advisories/GHSA-m4m5-j36m-8x72
CVE: CVE-2024-23636
Published: 2024-01-23
Description: SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76; https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvr; https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76
CVE: CVE-2023-51210
Published: 2024-01-23
Description: SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters in the UpdateProductQuantity function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://medium.com/%40nasir.synack/uncovering-critical-vulnerability-cve-2023-51210-in-prestashop-plugin-bundle-product-pack-ad7fb08bdc91; https://medium.com/%40nasir.synack/uncovering-critical-vulnerability-cve-2023-51210-in-prestashop-plugin-bundle-product-pack-ad7fb08bdc91
CVE: CVE-2024-22497
Published: 2024-01-23
Description: Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/cui2shark/security/blob/main/%28JFinalcms%20admin-login-password%29%20.md; https://github.com/cui2shark/security/blob/main/%28JFinalcms%20admin-login-password%29%20.md
CVE: CVE-2023-42143
Published: 2024-01-23
Description: Missing Integrity Check in Shelly TRV 20[PII_REDACTED]43/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipulated firmware file. The device is updated with the manipulated firmware.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219; https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219
CVE: CVE-2023-42144
Published: 2024-01-23
Description: Cleartext Transmission during initial setup in Shelly TRV 20[PII_REDACTED]4 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219; https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219
CVE: CVE-2023-46889
Published: 2024-01-23
Description: Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi access point. In this phase, MSH30Q needs to connect to the Internet through a Wi-Fi router. This is why MSH30Q asks for the Wi-Fi network name (SSID) and the Wi-Fi network password. When the user enters the password, the transmission of the Wi-Fi password and name between the MSH30Q and mobile application is observed in the Wi-Fi network. Although the Wi-Fi password is encrypted, a part of the decryption algorithm is public so we complemented the missing parts to decrypt it.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219; https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219
CVE: CVE-2023-6926
Published: 2024-01-23
Description: 
There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.


CVSS Score: 8.4 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-02
CVE: CVE-2023-7238
Published: 2024-01-23
Description: 
A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.


CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01
CVE: CVE-2023-38624
Published: 2024-01-23
Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is a similar, but not identical vulnerability as CVE-2023-38625 through CVE-2023-38627.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-998/; https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US
CVE: CVE-2023-38625
Published: 2024-01-23
Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is a similar, but not identical vulnerability as CVE-2023-38624.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-999/; https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US
CVE: CVE-2023-38626
Published: 2024-01-23
Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is a similar, but not identical vulnerability as CVE-2023-38625.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1000/; https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US
CVE: CVE-2023-38627
Published: 2024-01-23
Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is a similar, but not identical vulnerability as CVE-2023-38626.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1001/; https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US
CVE: CVE-2023-41176
Published: 2024-01-23
Description: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.

Please note, this vulnerability is similar to, but not identical to, CVE-2023-41177.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-078/; https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US
CVE: CVE-2023-41177
Published: 2024-01-23
Description: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.

Please note, this vulnerability is similar to, but not identical to, CVE-2023-41178.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-079/; https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US
CVE: CVE-2023-41178
Published: 2024-01-23
Description: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.

Please note, this vulnerability is similar to, but not identical to, CVE-2023-41176.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-080/; https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US