deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-29540
Published: 2020-12-08
Description: API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Systran Pure Neural Server as a Denial-of-Service proxy by sending a large amount of translation requests to a destination host on any given TCP port regardless of whether a web service is running on the destination port.
CVSS Score: 7.5 (HIGH)
References: https://grave-rose.medium.com/two-systran-vulnerabilities-and-their-exploits-8bc83ba29e14; https://www.systransoft.com/translation-products/systran-pure-neural-server/; https://grave-rose.medium.com/two-systran-vulnerabilities-and-their-exploits-8bc83ba29e14
CVE: CVE-2020-25955
Published: 2020-12-08
Description: SourceCodester Student Management System Project in PHP version 1.0 is vulnerable to stored a cross-site scripting (XSS) via the 'add subject' tab.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/160398/Student-Management-System-Project-PHP-1.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2020/Dec/4; https://seclists.org/fulldisclosure/2020/Dec/4
CVE: CVE-2020-26254
Published: 2020-12-08
Description: omniauth-apple is the OmniAuth strategy for "Sign In with Apple" (RubyGem omniauth-apple). In omniauth-apple before version 1.0.1 attackers can fake their email address during authentication. This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the info.email field of OmniAuth's Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker's choice including email addresses of other users. Applications not using info.email for identification but are instead using the uid field are not impacted in the same manner. Note, these applications may still be negatively affected if the value of info.email is being used for other purposes. Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.
CVSS Score: 7.7 (HIGH)
CWE: CWE-290, CWE-290
References: https://github.com/nhosoya/omniauth-apple/blob/master/CHANGELOG.md#101---2020-12-03; https://github.com/nhosoya/omniauth-apple/commit/b37d5409213adae2ca06a67fec14c8d3d07d9016; https://github.com/nhosoya/omniauth-apple/security/advisories/GHSA-49r3-2549-3633
CVE: CVE-2020-26255
Published: 2020-12-08
Description: Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881; https://github.com/getkirby/kirby/commit/db8f371b13036861c9cc5ba3e85e27f73fce5e09; https://github.com/getkirby/kirby/releases/tag/3.4.5
CVE: CVE-2020-29578
Published: 2020-12-08
Description: The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29578; https://github.com/koharin/koharin2/blob/main/CVE-2020-29578
CVE: CVE-2020-1971
Published: 2020-12-08
Description: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2021/09/14/2; https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e
CVE: CVE-2020-29564
Published: 2020-12-08
Description: The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29564; https://github.com/koharin/koharin2/blob/main/CVE-2020-29564
CVE: CVE-2020-29575
Published: 2020-12-08
Description: The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29575; https://github.com/koharin/koharin2/blob/main/CVE-2020-29575
CVE: CVE-2020-29576
Published: 2020-12-08
Description: The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29576; https://github.com/koharin/koharin2/blob/main/CVE-2020-29576
CVE: CVE-2020-29577
Published: 2020-12-08
Description: The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29577; https://github.com/koharin/koharin2/blob/main/CVE-2020-29577
CVE: CVE-2020-29579
Published: 2020-12-08
Description: The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29579; https://github.com/koharin/koharin2/blob/main/CVE-2020-29579
CVE: CVE-2020-29580
Published: 2020-12-08
Description: The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29580; https://github.com/koharin/koharin2/blob/main/CVE-2020-29580
CVE: CVE-2020-29581
Published: 2020-12-08
Description: The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29581; https://github.com/koharin/koharin2/blob/main/CVE-2020-29581
CVE: CVE-2020-29601
Published: 2020-12-08
Description: The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notary docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29601; https://github.com/koharin/koharin2/blob/main/CVE-2020-29601
CVE: CVE-2020-29602
Published: 2020-12-08
Description: The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System using the irssi docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29602; https://github.com/koharin/koharin2/blob/main/CVE-2020-29602
CVE: CVE-2020-10002
Published: 2020-12-08
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. A local user may be able to read arbitrary files.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211928
CVE: CVE-2020-10003
Published: 2020-12-08
Description: An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211928; https://support.apple.com/en-us/HT211929
CVE: CVE-2020-10004
Published: 2020-12-08
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211929
CVE: CVE-2020-10006
Published: 2020-12-08
Description: This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to access restricted files.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211931; http://seclists.org/fulldisclosure/2020/Dec/32
CVE: CVE-2020-10007
Published: 2020-12-08
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to determine kernel memory layout.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-10009
Published: 2020-12-08
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-10010
Published: 2020-12-08
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211928
CVE: CVE-2020-10011
Published: 2020-12-08
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 14.2 and iPadOS 14.2, macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211849; https://support.apple.com/en-us/HT211929
CVE: CVE-2020-10012
Published: 2020-12-08
Description: An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted document may lead to a cross site scripting attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-10013
Published: 2020-12-08
Description: A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.0, iOS 14.0 and iPadOS 14.0. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT211843; https://support.apple.com/en-us/HT211850; https://support.apple.com/kb/HT211849
CVE: CVE-2020-10014
Published: 2020-12-08
Description: A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to break out of its sandbox.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-10016
Published: 2020-12-08
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211928
CVE: CVE-2020-14205
Published: 2020-12-08
Description: The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker may leverage this issue to manipulate the integrity of dive logs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://wordpress.org/plugins/divebook/#developers; https://www.hooperlabs.xyz/disclosures/divebook.php; https://wordpress.org/plugins/divebook/#developers
CVE: CVE-2020-14206
Published: 2020-12-08
Description: The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/divebook/#developers; https://www.hooperlabs.xyz/disclosures/divebook.php; https://wordpress.org/plugins/divebook/#developers
CVE: CVE-2020-14207
Published: 2020-12-08
Description: The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via the divelog.php filter_diver parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://wordpress.org/plugins/divebook/#developers; https://www.hooperlabs.xyz/disclosures/divebook.php; https://wordpress.org/plugins/divebook/#developers
CVE: CVE-2020-26233
Published: 2020-12-08
Description: Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with submodules, Git will first clone the top-level repository and then recursively clone all submodules by starting new Git processes from the top-level working directory. If a malicious git.exe executable is present in the top-level repository then this binary will be started by Git Credential Manager Core when attempting to read configuration, and not git.exe as found on the %PATH%. This only affects GCM Core on Windows, not macOS or Linux-based distributions. GCM Core version 2.0.289 contains the fix for this vulnerability, and is available from the project's GitHub releases page. GCM Core 2.0.289 is also bundled in the latest Git for Windows release; version 2.29.2(3). As a workaround, users should avoid recursively cloning untrusted repositories with the --recurse-submodules option.
CVSS Score: 7.3 (HIGH)
CWE: CWE-706, CWE-706
References: https://blog.blazeinfosec.com/attack-of-the-clones-2-git-command-client-remote-code-execution-strikes-back/; https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt; https://github.com/microsoft/Git-Credential-Manager-Core/commit/61c0388e064babb3b4e60d3ec269e8a07ab3bc76
CVE: CVE-2020-27894
Published: 2020-12-08
Description: The issue was addressed with additional user controls. This issue is fixed in macOS Big Sur 11.0.1. Users may be unable to remove metadata indicating where files were downloaded from.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211931; http://seclists.org/fulldisclosure/2020/Dec/32
CVE: CVE-2020-28946
Published: 2020-12-08
Description: An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker (with network access to the device) to obtain the configuration file, including hashed credential data. Successful exploitation could allow access to hashed credential data with a single unauthenticated GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://plummac.com/project/ik-401/; https://www.cert.pl/news/single/coraz-wiecej-urzadzen-przemyslowych-podlaczonych-do-internetu/; https://plummac.com/project/ik-401/
CVE: CVE-2020-9849
Published: 2020-12-08
Description: An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0. A remote attacker may be able to leak memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E; https://support.apple.com/en-us/HT211843
CVE: CVE-2020-9922
Published: 2020-12-08
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. Processing a maliciously crafted email may lead to writing arbitrary files.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT211289; https://support.apple.com/en-us/HT211289
CVE: CVE-2020-9942
Published: 2020-12-08
Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211292; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-9943
Published: 2020-12-08
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14.0. A malicious application may be able to read restricted memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211843
CVE: CVE-2020-9944
Published: 2020-12-08
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14.0. An application may be able to read restricted memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2020/Dec/26; http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211843
CVE: CVE-2020-9945
Published: 2020-12-08
Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, Safari 14.0.1. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211931; https://support.apple.com/en-us/HT211934
CVE: CVE-2020-9947
Published: 2020-12-08
Description: A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2021/03/22/1; https://security.gentoo.org/glsa/202104-03; https://support.apple.com/en-us/HT211843
CVE: CVE-2020-9949
Published: 2020-12-08
Description: A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra, tvOS 14.0. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://seclists.org/fulldisclosure/2020/Dec/32; https://support.apple.com/en-us/HT211289; https://support.apple.com/en-us/HT211843
CVE: CVE-2020-9950
Published: 2020-12-08
Description: A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, tvOS 14.0, Safari 14.0, iOS 14.0 and iPadOS 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://support.apple.com/en-us/HT211843; https://support.apple.com/en-us/HT211844; https://support.apple.com/en-us/HT211845