deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-11424
Published: 2024-11-21
Description: The Slick Sitemap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slick-sitemap' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/slick-sitemap/trunk/slick-sitemap.php#L95; https://wordpress.org/plugins/slick-sitemap/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a2495fd6-5a36-4bdf-b4e0-68095072d820?source=cve
CVE: CVE-2024-11428
Published: 2024-11-21
Description: The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/lazy-load-videos-and-sticky-control/trunk/inc/classes/class-lazy-load-videos-and-sticky-control-shortcode.php; https://wordpress.org/plugins/lazy-load-videos-and-sticky-control/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9715c3-6ce0-46f8-820d-194bd0e8e6fd?source=cve
CVE: CVE-2024-11432
Published: 2024-11-21
Description: The SuevaFree Essential Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'counter' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/suevafree-essential-kit/trunk/core/shortcodes/counter.php; https://plugins.trac.wordpress.org/changeset/3193152/suevafree-essential-kit/trunk/core/shortcodes/counter.php; https://wordpress.org/plugins/suevafree-essential-kit/
CVE: CVE-2024-11435
Published: 2024-11-21
Description: The salavat counter Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/salavat-counter/trunk/wp-table-class.php#L85; https://plugins.trac.wordpress.org/changeset/3250829/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3ecdd962-7d85-4a60-956d-1e8a49507ab2?source=cve
CVE: CVE-2024-11438
Published: 2024-11-21
Description: The StreamWeasels Online Status Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-status-bar' shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3192626%40stream-status-for-twitch&new=3192626%40stream-status-for-twitch&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfbb817-1bb2-4829-9a63-d8e579053000?source=cve
CVE: CVE-2024-11440
Published: 2024-11-21
Description: The Grey Owl Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gol_button' shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/grey-owl-lightbox/trunk/functions/functions.php#L146; https://plugins.trac.wordpress.org/changeset/3352843/; https://wordpress.org/plugins/grey-owl-lightbox/
CVE: CVE-2024-11447
Published: 2024-11-21
Description: The Community by PeepSo – Download from PeepSo.com plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filter’ parameter in all versions up to, and including, 7.0.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.2/templates/activity/activity-stream-filters-simple.php#L131; https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.2/templates/activity/activity-stream-filters.php#L179; https://plugins.trac.wordpress.org/browser/peepso-core/trunk/classes/template.php#L68
CVE: CVE-2024-11455
Published: 2024-11-21
Description: The Include Mastodon Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'include-mastodon-feed' shortcode in all versions up to, and including, 1.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/include-mastodon-feed/tags/1.9.4/plugin.php#L730; https://www.wordfence.com/threat-intel/vulnerabilities/id/1ed075f2-778a-49f5-bd6e-439cd3f1cee6?source=cve
CVE: CVE-2024-11456
Published: 2024-11-21
Description: The Run Contests, Raffles, and Giveaways with ContestsWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3192738/contest-code-checker/trunk/free/admin/prizes/class-prizes-table.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1b68ff1e-ef79-4c11-a73c-591177d8dffe?source=cve
CVE: CVE-2024-11595
Published: 2024-11-21
Description: FiveCo RAP dissector infinite loop in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.8 (HIGH)
CWE: CWE-835
References: https://gitlab.com/wireshark/wireshark/-/issues/20176; https://www.wireshark.org/security/wnpa-sec-2024-14.html
CVE: CVE-2024-11596
Published: 2024-11-21
Description: ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://gitlab.com/wireshark/wireshark/-/issues/20214; https://www.wireshark.org/security/wnpa-sec-2024-15.html
CVE: CVE-2024-30896
Published: 2024-11-21
Description: InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API. The supplier has stated that InfluxDB 2.8.0 has addressed this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-922
References: https://github.com/XenoM0rph97/CVE-2024-30896; https://github.com/influxdata/influxdb/issues/24797; https://github.com/influxdata/influxdb/releases/tag/v2.8.0
CVE: CVE-2024-45663
Published: 2024-11-21
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 6.5 (MEDIUM)
References: https://www.ibm.com/support/pages/node/7175943; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-52067
Published: 2024-11-21
Description: Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with the default Logback configuration do not log Parameter Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is the recommendation mitigation, eliminating Parameter value logging from the flow synchronization process regardless of the Logback configuration.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://lists.apache.org/thread/9rz5rwn2zc7pfjq7ppqldqlc067tlcwd; http://www.openwall.com/lists/oss-security/2024/11/20/2
CVE: CVE-2024-52797
Published: 2024-11-21
Description: Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elasticsearch integration may generate syntactically invalid Elasticsearch queries in relation to previously acceptable search queries. From Opencast version 11.4 and newer, Elasticsearch queries are retried a configurable number of times in the case of error to handle temporary losses of connection to Elasticsearch. These invalid queries would fail, causing the retry mechanism to begin requerying with the same syntactically invalid query immediately, in an infinite loop. This causes a massive increase in log size which can in some cases cause a denial of service due to disk exhaustion.

Opencast 13.10 and Opencast 14.3 contain patches which address the base issue, with Opencast 16.7 containing changes which harmonize the search behaviour between the admin UI and external API. Users are strongly recommended to upgrade as soon as possible if running versions prior to 13.10 or 14.3. While the relevant endpoints require (by default) `ROLE_ADMIN` or `ROLE_API_SERIES_VIEW`, the problem queries are otherwise innocuous. This issue could be easily triggered by normal administrative work on an affected Opencast system. Those who run a version newer than 13.10 and 14.3 and see different results when searching in their admin UI vs your external API or LMS, may resolve the issue by upgrading to 16.7. No known workarounds for the vulnerability are available.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/opencast/opencast/commit/3d5ebd163674eb18e070f52b64a18f92188f98c3; https://github.com/opencast/opencast/pull/5033; https://github.com/opencast/opencast/pull/5150
CVE: CVE-2024-5029
Published: 2024-11-21
Description: The CM Table Of Contents  WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/f0f4a33c-9dd2-45ee-82e7-4b8bc2c20094/
CVE: CVE-2024-7517
Published: 2024-11-21
Description: A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated attacker to perform a privileged escalation via crafted use of the portcfg command.

This specific exploitation is only possible on IP Extension platforms: Brocade 7810, Brocade 7840, Brocade 7850 and on Brocade X6 or X7 directors with an SX-6 Extension blade installed. The attacker must be logged into the switch via SSH or serial console to conduct the attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25071
CVE: CVE-2024-8157
Published: 2024-11-21
Description: The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/9bc18c41-fc4c-48c9-bcec-323c502ae620/
CVE: CVE-2024-9111
Published: 2024-11-21
Description: The Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206655%40product-designer&new=3206655%40product-designer&sfp_email=&sfph_mail=; https://wordpress.org/plugins/product-designer/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/28126b4f-1cb6-4e91-b1c0-09f407d1dbf8?source=cve
CVE: CVE-2024-9371
Published: 2024-11-21
Description: The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.19/inc/class-branda-admin.php#L1871; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3191895%40branda-white-labeling&new=3191895%40branda-white-labeling&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/eb60e5c8-cbda-4488-816c-a7fdf2b39fd6?source=cve
CVE: CVE-2024-9442
Published: 2024-11-21
Description: The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/element-ready-lite/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/b97a555a-1eeb-4fc4-9338-bad8b9a0585d?source=cve
CVE: CVE-2024-9542
Published: 2024-11-21
Description: The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render function in modules/content-switcher/widgets/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3189030/sky-elementor-addons; https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0d9356-8083-4154-aa04-9008627dd3f5?source=cve
CVE: CVE-2024-9600
Published: 2024-11-21
Description: The Ditty  WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d1c78389-29eb-4dce-848c-e0eab85ff5cd/
CVE: CVE-2024-9768
Published: 2024-11-21
Description: The Formidable Forms  WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3c4ff11b-4a06-433d-8f0e[PII_REDACTED]c0/
CVE: CVE-2024-9828
Published: 2024-11-21
Description: The Taskbuilder  WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/eb2d0932-fd47-4aef-9d08-4377c742bb6e/
CVE: CVE-2024-9851
Published: 2024-11-21
Description: The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218947%40tour-operator&new=3218947%40tour-operator&sfp_email=&sfph_mail=; https://wordpress.org/plugins/tour-operator/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/08ef71da-50f2-4f7e-8a23-23adbabee09d?source=cve
CVE: CVE-2024-11587
Published: 2024-11-21
Description: A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php. The manipulation of the argument idName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/75; https://vuldb.com/?ctiid.285657; https://vuldb.com/?id.285657
CVE: CVE-2024-11588
Published: 2024-11-21
Description: A vulnerability was found in AVL-DiTEST-DiagDev libdoip 1.0.0. It has been rated as problematic. This issue affects the function DoIPConnection::reactOnReceivedTcpMessage of the file DoIPConnection.cpp. The manipulation leads to null pointer dereference.
CVSS Score: 3.5 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://github.com/AVL-DiTEST-DiagDev/libdoip/issues/11; https://vuldb.com/?ctiid.285659; https://vuldb.com/?id.285659
CVE: CVE-2024-11589
Published: 2024-11-21
Description: A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /expcatedit.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/kevin27392/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.285661
CVE: CVE-2024-11590
Published: 2024-11-21
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown functionality of the file /forget_password_process.php. The manipulation of the argument unm leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/1ighttack/CVE/issues/1; https://vuldb.com/?ctiid.285662
CVE: CVE-2024-7016
Published: 2024-11-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Smarttek Informatics Smart Doctor's allows Stored XSS required admin privileges.This issue affects Smart Doctor: through 21.11.2024.


NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-1865
CVE: CVE-2024-11088
Published: 2024-11-21
Description: The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-276
References: https://plugins.trac.wordpress.org/changeset/3190023/simple-membership; https://www.wordfence.com/threat-intel/vulnerabilities/id/c1558b08-a33b-4cf2-bacb-c88065f513cc?source=cve
CVE: CVE-2024-11089
Published: 2024-11-21
Description: The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to logged-in users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-276
References: https://plugins.trac.wordpress.org/changeset/3191193/anonymous-restricted-content; https://www.wordfence.com/threat-intel/vulnerabilities/id/95a01f44-2356-4ea4-b48e-80e3c6114efa?source=cve
CVE: CVE-2024-11591
Published: 2024-11-21
Description: A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-services.php. The manipulation of the argument sername leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Hacker0xone/CVE/issues/14; https://vuldb.com/?ctiid.285663
CVE: CVE-2024-53425
Published: 2024-11-21
Description: A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120
References: https://github.com/assimp/assimp/issues/5860
CVE: CVE-2024-53426
Published: 2024-11-21
Description: A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120
References: https://github.com/ntop/ntopng/issues/8793