deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4766
Published: 2024-05-14
Description: Different techniques existed to obscure the fullscreen notification in Firefox for Android.  These could have led to potential user confusion and spoofing attacks.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1871214; https://bugzilla.mozilla.org/show_bug.cgi?id=1871217; https://www.mozilla.org/security/advisories/mfsa2024-21/
CVE: CVE-2024-4767
Published: 2024-05-14
Description: If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-459, CWE-359
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1878577; https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html; https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
CVE: CVE-2024-4768
Published: 2024-05-14
Description: A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-281
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1886082; https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html; https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
CVE: CVE-2024-4769
Published: 2024-05-14
Description: When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses.  This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-351
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1886108; https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html; https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
CVE: CVE-2024-4770
Published: 2024-05-14
Description: When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1893270; https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html; https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
CVE: CVE-2024-4771
Published: 2024-05-14
Description: A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 126.
CVSS Score: 8.6 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1893891; https://www.mozilla.org/security/advisories/mfsa2024-21/; https://bugzilla.mozilla.org/show_bug.cgi?id=1893891
CVE: CVE-2024-4772
Published: 2024-05-14
Description: An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-338
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1870579; https://www.mozilla.org/security/advisories/mfsa2024-21/; https://bugzilla.mozilla.org/show_bug.cgi?id=1870579
CVE: CVE-2024-4773
Published: 2024-05-14
Description: When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been used to obfuscate a spoofed web site. This vulnerability affects Firefox < 126.
CVSS Score: 7.5 (HIGH)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1875248; https://www.mozilla.org/security/advisories/mfsa2024-21/; https://bugzilla.mozilla.org/show_bug.cgi?id=1875248
CVE: CVE-2024-4774
Published: 2024-05-14
Description: The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. This vulnerability affects Firefox < 126.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-758
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1886598; https://www.mozilla.org/security/advisories/mfsa2024-21/; https://bugzilla.mozilla.org/show_bug.cgi?id=1886598
CVE: CVE-2024-4775
Published: 2024-05-14
Description: An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue only affects the application when the profiler is running. This vulnerability affects Firefox < 126.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-431
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1887332; https://www.mozilla.org/security/advisories/mfsa2024-21/; https://bugzilla.mozilla.org/show_bug.cgi?id=1887332
CVE: CVE-2024-4776
Published: 2024-05-14
Description: A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability affects Firefox < 126.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1887343; https://www.mozilla.org/security/advisories/mfsa2024-21/; https://bugzilla.mozilla.org/show_bug.cgi?id=1887343
CVE: CVE-2024-4777
Published: 2024-05-14
Description: Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-416
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1878199%2C1893340; https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html; https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
CVE: CVE-2024-4778
Published: 2024-05-14
Description: Memory safety bugs present in Firefox 125. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1260
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1838834%2C1889291%2C1889595%2C1890204%2C1891545; https://www.mozilla.org/security/advisories/mfsa2024-21/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1838834%2C1889291%2C1889595%2C1890204%2C1891545
CVE: CVE-2024-0862
Published: 2024-05-14
Description: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an authenticated user to relay HTTP requests from the Protection server to otherwise private network addresses.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0001; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0001
CVE: CVE-2024-2637
Published: 2024-05-14
Description: An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-427
References: https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf; https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf
CVE: CVE-2024-32002
Published: 2024-05-14
Description: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22, CWE-434, CWE-59
References: http://www.openwall.com/lists/oss-security/2024/05/14/2; https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt; https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks
CVE: CVE-2024-32004
Published: 2024-05-14
Description: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.
CVSS Score: 8.1 (HIGH)
CWE: CWE-114
References: http://www.openwall.com/lists/oss-security/2024/05/14/2; https://git-scm.com/docs/git-clone; https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd[PII_REDACTED]08cbb69c8
CVE: CVE-2024-32020
Published: 2024-05-14
Description: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a "proper" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.
CVSS Score: 3.9 (LOW)
CWE: CWE-281
References: http://www.openwall.com/lists/oss-security/2024/05/14/2; https://github.com/git/git/commit/1204e1a824c34071019fe106348eaa6d88f9528d; https://github.com/git/git/commit/9e65df5eab274bf74c7b570107aacd1303a1e703
CVE: CVE-2024-3676
Published: 2024-05-14
Description: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control.  These accounts are able to send spoofed email to any users within the domains configured by the Administrator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002
CVE: CVE-2021-22280
Published: 2024-05-14
Description: Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code in the context of the product.
CVSS Score: 7.2 (HIGH)
CWE: CWE-427, CWE-20
References: https://www.br-automation.com/fileadmin/2021-10_DLL_Hijacking_Vulnerability_in_Automation_Studio-7dd34511.pdf; https://www.br-automation.com/fileadmin/2021-10_DLL_Hijacking_Vulnerability_in_Automation_Studio-7dd34511.pdf
CVE: CVE-2024-32021
Published: 2024-05-14
Description: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning
will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.
CVSS Score: 3.9 (LOW)
CWE: CWE-547
References: http://www.openwall.com/lists/oss-security/2024/05/14/2; https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7; https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
CVE: CVE-2024-32465
Published: 2024-05-14
Description: Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/05/14/2; https://git-scm.com/docs/git#_security; https://git-scm.com/docs/git-clone
CVE: CVE-2020-26312
Published: 2024-05-14
Description: Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsafe handling of symbolic links in an unpacking routine may 
enable attackers to read and/or write to arbitrary locations outside the
 designated target folder. The routine `untarFile` attempts to guard against creating symbolic links that point outside the directory a tar archive is extracted to. However, a malicious tarball first linking `subdir/parent` to `..` (allowed, because `subdir/..` falls within the archive root) and then linking `subdir/parent/escapes` to `..` results in a symbolic link pointing to the tarball’s parent directory, contrary to the routine’s goals. This issue may lead to arbitrary file write (with same permissions as the program running the unpack operation) if the attacker can control the archive file. Additionally, if the attacker has read access to the unpacked files, they may be able to read arbitrary system files the parent process has permissions to read. As of time of publication, no patch for this issue is available.

CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-787
References: https://github.com/dotmesh-io/dotmesh/blob/master/pkg/archiver/tar.go#L255; https://securitylab.github.com/advisories/GHSL-2020-254-zipslip-dotmesh/; https://github.com/dotmesh-io/dotmesh/blob/master/pkg/archiver/tar.go#L255
CVE: CVE-2022-28132
Published: 2024-05-14
Description: The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication mechanisms, view sensitive information stored in the database, and potentially exfiltrate data.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/50939; https://www.exploit-db.com/exploits/50939
CVE: CVE-2024-31556
Published: 2024-05-14
Description: An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/reportico-web/reportico/issues/53; https://github.com/reportico-web/reportico/issues/53
CVE: CVE-2024-3044
Published: 2024-05-14
Description: Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-356, CWE-94
References: https://lists.debian.org/debian-lts-announce/2024/05/msg00016.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TU3TYDXICKPYHMCNL7ARYYBXACEAYJ4/; https://www.libreoffice.org/about-us/security/advisories/CVE-2024-3044
CVE: CVE-2024-4561
Published: 2024-05-14
Description: 
In WhatsUp Gold versions released before 2023.1.2 , 

a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server.


CVSS Score: 4.2 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2
CVE: CVE-2024-4562
Published: 2024-05-14
Description: 
In WhatsUp Gold versions released before 2023.1.2 , 

an SSRF vulnerability exists in Whatsup Gold's 

Issue exists in the HTTP Monitoring functionality.  

Due to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality, what leads to the Server Side Request Forgery.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2; https://www.progress.com/network-monitoring; https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2
CVE: CVE-2023-33327
Published: 2024-05-14
Description: Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/leyka/wordpress-leyka-plugin-3-29-2-privilege-escalation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/leyka/wordpress-leyka-plugin-3-29-2-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-31466
Published: 2024-05-14
Description: There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-35175
Published: 2024-05-14
Description: sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: https://github.com/tg123/sshpiper/commit/2ddd69876a1e1119059debc59fe869cb4e754430; https://github.com/tg123/sshpiper/commit/70fb830dca26bea7ced772ce5d834a3e88ae7f53; https://github.com/tg123/sshpiper/security/advisories/GHSA-4w53-6jvp-gg52
CVE: CVE-2024-31467
Published: 2024-05-14
Description: There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt