deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-24703
Published: 2020-08-27
Description: An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.
CVSS Score: 8.8 (HIGH)
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0687/; https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0687/
CVE: CVE-2020-24704
Published: 2020-08-27
Description: An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0685/; https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0685/
CVE: CVE-2020-24705
Published: 2020-08-27
Description: An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
CVSS Score: 8.8 (HIGH)
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/; https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/
CVE: CVE-2020-24706
Published: 2020-08-27
Description: An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718; https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718
CVE: CVE-2020-3338
Published: 2020-08-27
Description: A vulnerability in the Protocol Independent Multicast (PIM) feature for IPv6 networks (PIM6) of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper error handling when processing inbound PIM6 packets. An attacker could exploit this vulnerability by sending multiple crafted PIM6 packets to an affected device. A successful exploit could allow the attacker to cause the PIM6 application to leak system memory. Over time, this memory leak could cause the PIM6 application to stop processing legitimate PIM6 traffic, leading to a DoS condition on the affected device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-755
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-pim-memleak-dos-tC8eP7uw; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-pim-memleak-dos-tC8eP7uw
CVE: CVE-2020-3394
Published: 2020-08-27
Description: A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to issue the enable command and get full administrative privileges. To exploit this vulnerability, the attacker would need to have valid credentials for the affected device. The vulnerability is due to a logic error in the implementation of the enable command. An attacker could exploit this vulnerability by logging in to the device and issuing the enable command. A successful exploit could allow the attacker to gain full administrative privileges without using the enable password. Note: The Enable Secret feature is disabled by default.
CVSS Score: 7.8 (HIGH)
CWE: CWE-285, CWE-862
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3n9k-priv-escal-3QhXJBC; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3n9k-priv-escal-3QhXJBC
CVE: CVE-2020-3397
Published: 2020-08-27
Description: A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of a specific type of BGP MVPN update message. An attacker could exploit this vulnerability by sending this specific, valid BGP MVPN update message to a targeted device. A successful exploit could allow the attacker to cause one of the BGP-related routing applications to restart multiple times, leading to a system-level restart. Note: The Cisco implementation of BGP accepts incoming BGP traffic from only explicitly configured peers. To exploit this vulnerability, an attacker must send a specific BGP MVPN update message over an established TCP connection that appears to come from a trusted BGP peer. To do so, the attacker must obtain information about the BGP peers in the trusted network of the affected system.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxosbgp-nlri-dos-458rG2OQ; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxosbgp-nlri-dos-458rG2OQ
CVE: CVE-2020-3398
Published: 2020-08-27
Description: A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a BGP session to repeatedly reset, causing a partial denial of service (DoS) condition due to the BGP session being down. The vulnerability is due to incorrect parsing of a specific type of BGP MVPN update message. An attacker could exploit this vulnerability by sending this BGP MVPN update message to a targeted device. A successful exploit could allow the attacker to cause the BGP peer connections to reset, which could lead to BGP route instability and impact traffic. The incoming BGP MVPN update message is valid but is parsed incorrectly by the NX-OS device, which could send a corrupted BGP update to the configured BGP peer. Note: The Cisco implementation of BGP accepts incoming BGP traffic from only explicitly configured peers. To exploit this vulnerability, an attacker must send a specific BGP MVPN update message over an established TCP connection that appears to come from a trusted BGP peer. To do so, the attacker must obtain information about the BGP peers in the trusted network of the affected system.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxosbgp-mvpn-dos-K8kbCrJp; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxosbgp-mvpn-dos-K8kbCrJp
CVE: CVE-2020-3415
Published: 2020-08-27
Description: A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent affected device. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the Cisco Discovery Protocol process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Exploitation of this vulnerability also requires jumbo frames to be enabled on the interface that receives the crafted Cisco Discovery Protocol packets on the affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-dme-rce-cbE3nhZS; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-dme-rce-cbE3nhZS
CVE: CVE-2020-3454
Published: 2020-08-27
Description: A vulnerability in the Call Home feature of Cisco NX-OS Software could allow an authenticated, remote attacker to inject arbitrary commands that could be executed with root privileges on the underlying operating system (OS). The vulnerability is due to insufficient input validation of specific Call Home configuration parameters when the software is configured for transport method HTTP. An attacker could exploit this vulnerability by modifying parameters within the Call Home configuration on an affected device. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying OS.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-callhome-cmdinj-zkxzSCY; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-callhome-cmdinj-zkxzSCY
CVE: CVE-2020-3504
Published: 2020-08-27
Description: A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of CLI command parameters. An attacker could exploit this vulnerability by executing specific commands on the local-mgmt CLI on an affected device. A successful exploit could allow the attacker to cause internal system processes to fail to terminate properly, which could result in a buildup of stuck processes and lead to slowness in accessing the UCS Manager CLI and web UI. A sustained attack may result in a restart of internal UCS Manager processes and a temporary loss of access to the UCS Manager CLI and web UI.
CVSS Score: 3.3 (LOW)
CWE: CWE-664, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-cli-dos-GQUxCnTe; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-cli-dos-GQUxCnTe
CVE: CVE-2020-3517
Published: 2020-08-27
Description: A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device. The attack vector is configuration dependent and could be remote or adjacent. For more information about the attack vector, see the Details section of this advisory. The vulnerability is due to insufficient error handling when the affected software parses Cisco Fabric Services messages. An attacker could exploit this vulnerability by sending malicious Cisco Fabric Services messages to an affected device. A successful exploit could allow the attacker to cause a reload of an affected device, which could result in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-476, CWE-476
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxos-nxos-cfs-dos-dAmnymbd; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxos-nxos-cfs-dos-dAmnymbd
CVE: CVE-2020-24196
Published: 2020-08-27
Description: An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://packetstormsecurity.com/files/158683/Online-Bike-Rental-1.0-Shell-Upload.html; https://packetstormsecurity.com/files/158683/Online-Bike-Rental-1.0-Shell-Upload.html
CVE: CVE-2020-24202
Published: 2020-08-27
Description: File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allows remote attackers to conduct code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/hyd3sec/HouseRental_Unauth_RCE/blob/master/HouseRentalRCE.py; https://projectworlds.in/free-projects/php-projects/house-rental-and-property-listing-project-php-mysql/; https://github.com/hyd3sec/HouseRental_Unauth_RCE/blob/master/HouseRentalRCE.py
CVE: CVE-2020-24203
Published: 2020-08-27
Description: Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425, CWE-434
References: https://github.com/hyd3sec/TravelManagementSystemRCE; https://projectworlds.in/free-projects/php-projects/travel-management-system-project-in-php-mysql/; https://github.com/hyd3sec/TravelManagementSystemRCE
CVE: CVE-2020-24716
Published: 2020-08-27
Description: OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f; https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1; https://jira.ixsystems.com/browse/NAS-107270
CVE: CVE-2020-24717
Published: 2020-08-27
Description: OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/openzfs/zfs/commit/716b53d0a14c72bda16c0872565dd1909757e73f; https://github.com/openzfs/zfs/compare/zfs-0.8.4...zfs-2.0.0-rc1; https://jira.ixsystems.com/browse/NAS-107270
CVE: CVE-2020-5383
Published: 2020-08-27
Description: Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerability in the Likewise component. A remote unauthenticated malicious attacker may potentially exploit this vulnerability to cause a process restart.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/security/en-us/details/546005/DSA-2020-189-Dell-EMC-Isilon-OneFS-and-Dell-EMC-PowerScale-Security-Update-for-Buffer-Overflow-Vu; https://www.dell.com/support/security/en-us/details/546005/DSA-2020-189-Dell-EMC-Isilon-OneFS-and-Dell-EMC-PowerScale-Security-Update-for-Buffer-Overflow-Vu
CVE: CVE-2020-24618
Published: 2020-08-27
Description: In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue description without appropriate access.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://youtrack.jetbrains.com/issue/JT-59265
CVE: CVE-2020-15601
Published: 2020-08-27
Description: If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication. Enabling multi-factor authentication prevents this attack. Installations using manager native authentication or SAML authentication are not impacted by this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://success.trendmicro.com/solution/000252039; https://www.zerodayinitiative.com/advisories/ZDI-20-1077/; https://success.trendmicro.com/solution/000252039
CVE: CVE-2020-15605
Published: 2020-08-27
Description: If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication. Enabling multi-factor authentication prevents this attack. Installations using manager native authentication or SAML authentication are not impacted by this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://success.trendmicro.com/solution/000252039; https://www.zerodayinitiative.com/advisories/ZDI-20-1083/; https://success.trendmicro.com/solution/000252039
CVE: CVE-2020-8602
Published: 2020-08-27
Description: A vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro Vulnerability Protection 2.0 SP2 may allow an authenticated attacker with full control privileges to bypass file integrity checks, leading to remote code execution.
CVSS Score: 7.2 (HIGH)
References: https://success.trendmicro.com/solution/000252039; https://success.trendmicro.com/solution/000252039
CVE: CVE-2020-10517
Published: 2020-08-27
Description: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in versions 2.21.6, 2.20.15, and 2.19.21. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://enterprise.github.com/releases/2.19.21/notes; https://enterprise.github.com/releases/2.20.15/notes; https://enterprise.github.com/releases/2.21.6/notes
CVE: CVE-2020-10518
Published: 2020-08-27
Description: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://enterprise.github.com/releases/2.19.21/notes; https://enterprise.github.com/releases/2.20.15/notes; https://enterprise.github.com/releases/2.21.6/notes
CVE: CVE-2020-24714
Published: 2020-08-27
Description: The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname option.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://scalyr-static.s3.amazonaws.com/technical-details/index.html; https://scalyr-static.s3.amazonaws.com/technical-details/index.html
CVE: CVE-2020-24715
Published: 2020-08-27
Description: The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://scalyr-static.s3.amazonaws.com/technical-details/index.html; https://scalyr-static.s3.amazonaws.com/technical-details/index.html
CVE: CVE-2020-5621
Published: 2020-08-28
Description: Cross-site request forgery (CSRF) vulnerability in NETGEAR switching hubs (GS716Tv2 Firmware version 5.4.2.30 and earlier, and GS724Tv3 Firmware version 5.4.2.30 and earlier) allow remote attackers to hijack the authentication of administrators and alter the settings of the device via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN29903998/index.html; https://jvn.jp/en/jp/JVN29903998/index.html; https://www.netgear.com/support/product/gs716Tv2.aspx
CVE: CVE-2020-5623
Published: 2020-08-28
Description: NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://jvn.jp/en/jp/JVN77402327/index.html; https://jvn.jp/en/jp/JVN77402327/index.html
CVE: CVE-2020-5624
Published: 2020-08-28
Description: SQL injection vulnerability in the XooNIps 3.48 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN40725650/index.html; https://xoonips.osdn.jp/; https://xoonips.osdn.jp/modules/news/index.php?page=article&storyid=12
CVE: CVE-2020-5625
Published: 2020-08-28
Description: Cross-site scripting vulnerability in XooNIps 3.48 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN40725650/index.html; https://xoonips.osdn.jp/; https://xoonips.osdn.jp/modules/news/index.php?page=article&storyid=12
CVE: CVE-2019-18392
Published: 2020-08-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-19499
Published: 2020-08-28
Description: Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-4533
Published: 2020-08-28
Description: IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input validation. IBM X-Force ID: 165589.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165589; https://www.ibm.com/support/pages/node/6323645; https://exchange.xforce.ibmcloud.com/vulnerabilities/165589
CVE: CVE-2019-4579
Published: 2020-08-28
Description: IBM Resilient SOAR 38 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 167236.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167236; https://www.ibm.com/support/pages/node/6323783; https://exchange.xforce.ibmcloud.com/vulnerabilities/167236
CVE: CVE-2020-4559
Published: 2020-08-28
Description: IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183613; https://www.ibm.com/support/pages/node/6323757; https://exchange.xforce.ibmcloud.com/vulnerabilities/183613