deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-51245
Published: 2024-11-01
Description: In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51247
Published: 2024-11-01
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51248
Published: 2024-11-01
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-51431
Published: 2024-11-01
Description: LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/MatJosephs/CVEs/tree/main/CVE-2024-51431; https://www.lb-link.com/
CVE: CVE-2024-51483
Published: 2024-11-01
Description: changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
CWE: CWE-22
References: https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19; https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35; https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-cwgg-57xj-g77r
CVE: CVE-2024-51492
Published: 2024-11-01
Description: Zusam is a free and open-source way to self-host private forums. Prior to version 0.5.6, specially crafted SVG files uploaded to the service as images allow for unrestricted script execution on (raw) image load. With certain payloads, theft of the target user’s long-lived session token is possible. Note that Zusam, at the time of writing, uses a user’s static API key as a long-lived session token, and these terms can be used interchangeably on the platform. This session token/API key remains valid indefinitely, so long as the user doesn’t expressly request a new one via their Settings page. Version 0.5.6 fixes the cross-site scripting vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/zusam/zusam/commit/5930fdf86fa4abed01f0b345c8ec3c443656db9a; https://github.com/zusam/zusam/releases/tag/0.5.6; https://github.com/zusam/zusam/security/advisories/GHSA-96fx-5rqv-jfxh
CVE: CVE-2024-48353
Published: 2024-11-01
Description: Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922, CWE-922
References: https://www.yealink.com/en/trust-center/security-advisories/b1998ab629254ca3
CVE: CVE-2024-51252
Published: 2024-11-01
Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE: CVE-2024-44232
Published: 2024-11-01
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Parsing a maliciously crafted video file may lead to unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44233
Published: 2024-11-01
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Parsing a maliciously crafted video file may lead to unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44234
Published: 2024-11-01
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Parsing a maliciously crafted video file may lead to unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-9191
Published: 2024-11-01
Description: The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.

Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected.
CVSS Score: 7.1 (HIGH)
CWE: CWE-276, CWE-276
References: https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4; https://trust.okta.com/security-advisories/
CVE: CVE-2024-10310
Published: 2024-11-02
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Gallery Widget 'image_title' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3176764/bdthemes-element-pack-lite/trunk/modules/custom-gallery/widgets/custom-gallery.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/144d755a-e61a-4ecd-9d9a-9c6e3a1e6ea2?source=cve
CVE: CVE-2024-10540
Published: 2024-11-02
Description: The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'service' parameter of the bookingpress_form shortcode in all versions up to, and including, 1.1.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress.php#L358; https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/frontend/class.bookingpress_appointment_bookings.php#L3683; https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/frontend/class.bookingpress_appointment_bookings.php#L4620
CVE: CVE-2024-8739
Published: 2024-11-02
Description: The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-recaptcha-integration/tags/1.2.5/inc/class-wp_recaptcha_options.php#L362; https://plugins.trac.wordpress.org/browser/wp-recaptcha-integration/tags/1.3.0/inc/class-wp_recaptcha_options.php#L405; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3176796%40wp-recaptcha-integration&new=3176796%40wp-recaptcha-integration&sfp_email=&sfph_mail=
CVE: CVE-2024-9868
Published: 2024-11-02
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate Widget 'url' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3176764/bdthemes-element-pack-lite/trunk/modules/age-gate/widgets/age-gate.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/94efdb07-653b-4838-b584-e45e9ab9b7a5?source=cve
CVE: CVE-2024-51774
Published: 2024-11-02
Description: qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://news.ycombinator.com/item?id=42004219; https://sharpsec.run/rce-vulnerability-in-qbittorrent/; https://www.qbittorrent.org/news
CVE: CVE-2024-9896
Published: 2024-11-02
Description: The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bbp-core/trunk/includes/features/bbpc_attachments/code/front.php#L284; https://plugins.trac.wordpress.org/changeset/3179353/; https://wordpress.org/plugins/bbp-core/#developers
CVE: CVE-2024-10697
Published: 2024-11-02
Description: A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac of the component API Endpoint. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac6_rce_WriteFacMac/tenda_ac6_rce_WriteFacMac.md; https://vuldb.com/?ctiid.282865; https://vuldb.com/?id.282865
CVE: CVE-2024-10698
Published: 2024-11-02
Description: A vulnerability was found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this issue is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac6_stackflow_formSetDeviceName/tenda_ac6_stackflow_formSetDeviceName.md; https://vuldb.com/?ctiid.282866; https://vuldb.com/?id.282866
CVE: CVE-2024-10699
Published: 2024-11-02
Description: A vulnerability was found in code-projects Wazifa System 1.0. It has been classified as critical. This affects an unknown part of the file /controllers/logincontrol.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/lan041221/cve/blob/main/sql9.md; https://vuldb.com/?ctiid.282867
CVE: CVE-2024-10700
Published: 2024-11-02
Description: A vulnerability was found in code-projects University Event Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file submit.php. The manipulation of the argument name/email/title/Year/gender/fromdate/todate/people leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "name" to be affected. But it must be assumed that a variety of other parameters is affected too.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-707, CWE-89
References: https://code-projects.org/; https://github.com/aa[PII_REDACTED]/CVE/blob/main/sqlInjection.md; https://vuldb.com/?ctiid.282868
CVE: CVE-2024-10701
Published: 2024-11-02
Description: A vulnerability was found in PHPGurukul Car Rental Portal 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Car%20Rental%20Portal%203.0%20-%20(search.php).md; https://phpgurukul.com/; https://vuldb.com/?ctiid.282869
CVE: CVE-2024-10702
Published: 2024-11-02
Description: A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/imTedCao/cve/issues/1; https://vuldb.com/?ctiid.282870
CVE: CVE-2024-10730
Published: 2024-11-03
Description: A vulnerability, which was classified as critical, has been found in Tongda OA up to 11.6. This issue affects some unknown processing of the file /pda/appcenter/web_show.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/LvZCh/td/issues/15; https://vuldb.com/?ctiid.282899; https://vuldb.com/?id.282899
CVE: CVE-2024-10731
Published: 2024-11-03
Description: A vulnerability, which was classified as critical, was found in Tongda OA up to 11.10. Affected is an unknown function of the file /pda/appcenter/check_seal.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/LvZCh/td/issues/16; https://vuldb.com/?ctiid.282900; https://vuldb.com/?id.282900
CVE: CVE-2024-10732
Published: 2024-11-03
Description: A vulnerability has been found in Tongda OA 2017 up to 11.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /module/word_model/view/index.php. The manipulation of the argument query_str leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/LvZCh/td/issues/17; https://vuldb.com/?ctiid.282901; https://vuldb.com/?id.282901
CVE: CVE-2024-10733
Published: 2024-11-03
Description: A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument uid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/415Curry/cve/issues/1; https://vuldb.com/?ctiid.282902
CVE: CVE-2024-10734
Published: 2024-11-03
Description: A vulnerability was found in Project Worlds Life Insurance Management System 1.0. It has been classified as critical. This affects an unknown part of the file /editPayment.php. The manipulation of the argument recipt_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/peteryang520/Cve-report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.282903; https://vuldb.com/?id.282903
CVE: CVE-2024-10735
Published: 2024-11-03
Description: A vulnerability was found in Project Worlds Life Insurance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /editNominee.php. The manipulation of the argument nominee_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GKb0y/Cve-report/blob/main/SQLi-life-insurance-management-system.md; https://vuldb.com/?ctiid.282904; https://vuldb.com/?id.282904
CVE: CVE-2024-10736
Published: 2024-11-03
Description: A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/EddieAy/cve/issues/3; https://vuldb.com/?ctiid.282905; https://vuldb.com/?id.282905
CVE: CVE-2024-10737
Published: 2024-11-03
Description: A vulnerability classified as critical has been found in Codezips Free Exam Hall Seating Management System 1.0. Affected is an unknown function of the file /teacher.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/Scholar-XD/CVE/issues/1; https://vuldb.com/?ctiid.282906; https://vuldb.com/?id.282906
CVE: CVE-2024-10738
Published: 2024-11-03
Description: A vulnerability classified as critical was found in itsourcecode Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file manage-breed.php. The manipulation of the argument breed leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Nightmaremassacre/cve/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.282907
CVE: CVE-2024-10739
Published: 2024-11-03
Description: A vulnerability, which was classified as critical, has been found in code-projects E-Health Care System 1.0. Affected by this issue is some unknown functionality of the file /Admin/adminlogin.php. The manipulation of the argument email/admin_pswd as part of String leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "email" to be affected. But it must be assumed that parameter "admin_pswd" is affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql11.md; https://vuldb.com/?ctiid.282908
CVE: CVE-2024-10740
Published: 2024-11-03
Description: A vulnerability, which was classified as critical, was found in code-projects E-Health Care System up to 1.0. This affects an unknown part of the file /Admin/consulting_detail.php. The manipulation of the argument consulting_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/[PII_REDACTED]/cve/blob/main/sql.md; https://vuldb.com/?ctiid.282909
CVE: CVE-2024-10741
Published: 2024-11-03
Description: A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file /Users/registration.php. The manipulation of the argument f_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/maxihongtatum/cve/blob/main/sql14.md; https://vuldb.com/?ctiid.282910
CVE: CVE-2024-10742
Published: 2024-11-03
Description: A vulnerability was found in code-projects Wazifa System 1.0 and classified as critical. This issue affects some unknown processing of the file /controllers/control.php. The manipulation of the argument to leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/xiaokka/cve/blob/main/sql.md; https://vuldb.com/?ctiid.282911
CVE: CVE-2024-10743
Published: 2024-11-03
Description: A vulnerability was found in PHPGurukul Online Shopping Portal 2.0. It has been classified as problematic. Affected is an unknown function of the file /shopping/admin/assets/plugins/DataTables/examples/examples_support/editable_ajax.php. The manipulation of the argument value leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Online%20Shopping%20Portal%202.0%20-%20(editable_ajax.php).md; https://phpgurukul.com/; https://vuldb.com/?ctiid.282912
CVE: CVE-2024-10744
Published: 2024-11-03
Description: A vulnerability was found in PHPGurukul Online Shopping Portal 2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/assets/plugins/DataTables/media/unit_testing/templates/complex_header_2.php. The manipulation of the argument scripts leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Online%20Shopping%20Portal%202.0%20-%20(complex_header_2.php).md; https://phpgurukul.com/; https://vuldb.com/?ctiid.282913