deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-50731
Published: 2023-12-22
Description: MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directory using the path injection vulnerability, the potentially dangerous file is not deleted. Arbitrary file contents can be written due to `f.write(chunk)` on line 125. Mindsdb does check later on line 149 in the `save_file` method in `file-controller.py` which calls the `_handle_source` method in `file_handler.py` if a file is of one of the types `csv`, `json`, `parquet`, `xls`, or `xlsx`. However, since the check happens after the file has already been written, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle_source` method will return an error. The same user-controlled source source is used also in another path injection sink on line 138. This leads to another path injection, which allows an attacker to delete any `zip` or `tar.gz` files on the server.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918, CWE-22
References: https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125; https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138; https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj
CVE: CVE-2023-50924
Published: 2023-12-22
Description: Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript into other user's sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/engelsystem/engelsystem/commit/efda1ffc1ce59f02a7d237d9087adea26e73ec5f; https://github.com/engelsystem/engelsystem/security/advisories/GHSA-p5ch-rrpm-wvhm; https://github.com/engelsystem/engelsystem/commit/efda1ffc1ce59f02a7d237d9087adea26e73ec5f
CVE: CVE-2023-50928
Published: 2023-12-22
Description: "Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79; https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32r; https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79
CVE: CVE-2023-51387
Published: 2023-12-22
Description: Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be some simple expressions. However, due to improper sanitization for alert expressions in version prior to 1.4.1, a malicious user can use a crafted alert expression to execute any command on hertzbeat server. A malicious user who has access to alert define function can execute any command in hertzbeat instance. This issue is fixed in version 1.4.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/dromara/hertzbeat/blob/6b[PII_REDACTED]20ad1df6f4ed4b6713bb4885d8e2/home/blog/2023-09-26-hertzbeat-v1.4.1.md; https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2; https://github.com/dromara/hertzbeat/security/advisories/GHSA-4576-m8px-w9qj
CVE: CVE-2023-51449
Published: 2023-12-22
Description: Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-22
References: https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76; https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055; https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2
CVE: CVE-2023-51451
Published: 2023-12-22
Description: Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator's API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/getsentry/self-hosted/releases/tag/23.12.1; https://github.com/getsentry/symbolicator/pull/1343; https://github.com/getsentry/symbolicator/releases/tag/23.12.1
CVE: CVE-2023-51650
Published: 2023-12-22
Description: Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.

CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/dromara/hertzbeat/releases/tag/v1.4.1; https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2; https://github.com/dromara/hertzbeat/releases/tag/v1.4.1
CVE: CVE-2023-51651
Published: 2023-12-22
Description: AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: https://github.com/aws/aws-sdk-php/commit/aebc9f801438746ac4ade327551576cb75f635f2; https://github.com/aws/aws-sdk-php/releases/tag/3.288.1; https://github.com/aws/aws-sdk-php/security/advisories/GHSA-557v-xcg6-rm5m
CVE: CVE-2023-51386
Published: 2023-12-22
Description: Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79; https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-p7w3-j66h-m7mx; https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79
CVE: CVE-2023-6971
Published: 2023-12-23
Description: The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.
CVSS Score: 8.1 (HIGH)
CWE: CWE-829
References: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php; https://plugins.trac.wordpress.org/changeset/3012745/backup-backup; https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=cve
CVE: CVE-2023-6972
Published: 2023-12-23
Description: The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php; https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/bypasser.php; https://plugins.trac.wordpress.org/changeset/3012745/backup-backup
CVE: CVE-2023-7002
Published: 2023-12-23
Description: The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9  via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1503; https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1518; https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L88
CVE: CVE-2023-5961
Published: 2023-12-23
Description: A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.


CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability
CVE: CVE-2023-5962
Published: 2023-12-23
Description: A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lead an attacker to get unexpected authorization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-328, CWE-327
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability
CVE: CVE-2020-36769
Published: 2023-12-23
Description: The Widget Settings Importer/Exporter Plugin  for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.wordfence.com/blog/2020/04/unpatched-high-severity-vulnerability-in-widget-settings-importer-exporter-plugin/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e14f0fc6-fca4-4dd7-8f7b-ed5ed535c9af?source=cve; https://www.wordfence.com/blog/2020/04/unpatched-high-severity-vulnerability-in-widget-settings-importer-exporter-plugin/
CVE: CVE-2023-6744
Published: 2023-12-23
Description: The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and including, 4.23.1 due to insufficient input sanitization and output escaping on user supplied custom field data. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.elegantthemes.com/api/changelog/divi.txt; https://www.wordfence.com/threat-intel/vulnerabilities/id/999475c5-5f17-47fa-a0d0-47cb5a8a0eb4?source=cve; https://www.elegantthemes.com/api/changelog/divi.txt
CVE: CVE-2023-7008
Published: 2023-12-23
Description: A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-300
References: https://access.redhat.com/errata/RHSA-2024:2463; https://access.redhat.com/errata/RHSA-2024:3203; https://access.redhat.com/security/cve/CVE-2023-7008
CVE: CVE-2014-125108
Published: 2023-12-23
Description: A vulnerability was found in w3c online-spellchecker-py up to 20140130. It has been rated as problematic. This issue affects some unknown processing of the file spellchecker. The manipulation leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is d6c21fd8187c5db2a50425ff80694149e75d722e. It is recommended to apply a patch to fix this issue. The identifier VDB-248849 was assigned to this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-79
References: https://github.com/w3c/online-spellchecker-py/commit/d6c21fd8187c5db2a50425ff80694149e75d722e; https://vuldb.com/?ctiid.248849; https://vuldb.com/?id.248849
CVE: CVE-2016-15036
Published: 2023-12-23
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Deis Workflow Manager up to 2.3.2. It has been classified as problematic. This affects an unknown part. The manipulation leads to race condition. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.3.3 is able to address this issue. The patch is named 31fe3bccbdde134a185752e53380330d16053f7f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248847. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-362
References: https://github.com/deis/workflow-manager/commit/31fe3bccbdde134a185752e53380330d16053f7f; https://github.com/deis/workflow-manager/pull/94; https://github.com/deis/workflow-manager/releases/tag/v2.3.3
CVE: CVE-2023-49594
Published: 2023-12-23
Description: An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using  DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-201
References: https://github.com/instipod/DuoUniversalKeycloakAuthenticator/releases/tag/1.0.8; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1907; https://github.com/instipod/DuoUniversalKeycloakAuthenticator/releases/tag/1.0.8
CVE: CVE-2023-7090
Published: 2023-12-23
Description: A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://access.redhat.com/security/cve/CVE-2023-7090; https://bugzilla.redhat.com/show_bug.cgi?id=2255723; https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
CVE: CVE-2023-51763
Published: 2023-12-24
Description: csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://github.com/activeadmin/activeadmin/commit/697be2b183491beadc8f0b7d8b5bfb44f2387909; https://github.com/activeadmin/activeadmin/pull/8161; https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0
CVE: CVE-2023-51764
Published: 2023-12-24
Description: Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: http://www.openwall.com/lists/oss-security/2023/12/24/1; http://www.openwall.com/lists/oss-security/2023/12/25/1; http://www.openwall.com/lists/oss-security/2024/05/09/3
CVE: CVE-2023-51765
Published: 2023-12-24
Description: sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: http://www.openwall.com/lists/oss-security/2023/12/24/1; http://www.openwall.com/lists/oss-security/2023/12/25/1; http://www.openwall.com/lists/oss-security/2023/12/26/5
CVE: CVE-2023-51766
Published: 2023-12-24
Description: Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: http://www.openwall.com/lists/oss-security/2023/12/24/1; http://www.openwall.com/lists/oss-security/2023/12/25/1; http://www.openwall.com/lists/oss-security/2023/12/29/2
CVE: CVE-2023-51767
Published: 2023-12-24
Description: OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states "we do not consider it to be the application's responsibility to defend against platform architectural weaknesses."
CVSS Score: 7.0 (HIGH)
References: https://access.redhat.com/security/cve/CVE-2023-51767; https://arxiv.org/abs/2309.02545; https://bugzilla.redhat.com/show_bug.cgi?id=2255850
CVE: CVE-2023-51714
Published: 2023-12-24
Description: An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://codereview.qt-project.org/c/qt/qtbase/+/524864; https://codereview.qt-project.org/c/qt/qtbase/+/524865/3; https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
CVE: CVE-2023-7091
Published: 2023-12-24
Description: A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-248938 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/sweatxi/BugHub/blob/main/Dreamer-CMS.pdf; https://vuldb.com/?ctiid.248938; https://vuldb.com/?id.248938
CVE: CVE-2023-7101
Published: 2023-12-24
Description: Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
CVSS Score: 7.8 (HIGH)
CWE: CWE-95, CWE-94
References: http://www.openwall.com/lists/oss-security/2023/12/29/4; https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
CVE: CVE-2023-7102
Published: 2023-12-24
Description: Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1104
References: https://github.com/haile01/perl_spreadsheet_excel_rce_poc; https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md