deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7884
Published: 2024-09-05
Description: When a canister method is called via ic_cdk::call* , a new Future CallFuture is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState.  A bug in the polling implementation of the CallFuture allows multiple references to be held for this internal state and not all references were dropped before the Future is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 
Impact Canisters built in Rust with ic_cdk and ic_cdk_timers are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. In the worst case, this could lead to heap memory exhaustion triggered by an attacker. Motoko based canisters are not affected by the bug.
PatchesThe patch has been backported to all minor versions between >= 0.8.0, <= 0.15.0. The patched versions available are 0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1 and their previous versions have been yanked. WorkaroundsThere are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of ic_cdk to avoid running out of Wasm heap memory. 
Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://docs.rs/ic-cdk/latest/ic_cdk/; https://github.com/dfinity/cdk-rs/pull/509; https://internetcomputer.org/docs/current/references/ic-interface-spec
CVE: CVE-2024-8461
Published: 2024-09-05
Description: A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/leetsun/IoT-Vuls/tree/main/Dlink-dns320/4; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://vuldb.com/?ctiid.276627
CVE: CVE-2024-8462
Published: 2024-09-05
Description: A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390.1 is able to address this issue. The patch is identified as acfe7786152f036f2476f93ab[PII_REDACTED]fa9e3. It is recommended to upgrade the affected component.
CVSS Score: 3.7 (LOW)
CWE: CWE-307
References: https://github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab[PII_REDACTED]fa9e3; https://github.com/windmill-labs/windmill/releases/tag/v1.390.1; https://vuldb.com/?ctiid.276630
CVE: CVE-2024-8463
Published: 2024-09-05
Description: File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via webshell.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8464
Published: 2024-09-05
Description: SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.php, and retrieve all the information stored in it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8465
Published: 2024-09-05
Description: SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and retrieve all the information stored in it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8466
Published: 2024-09-05
Description: SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php, and retrieve all the information stored in it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8467
Published: 2024-09-05
Description: SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrieve all the information stored in it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8468
Published: 2024-09-05
Description: SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the information stored in it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8469
Published: 2024-09-05
Description: SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrieve all the information stored in it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8470
Published: 2024-09-05
Description: SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php, and retrieve all the information stored in it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8471
Published: 2024-09-05
Description: Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8472
Published: 2024-09-05
Description: Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through multiple parameters in /jobportal/index.php.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-8473
Published: 2024-09-05
Description: Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through user_email parameter in /jobportal/admin/login.php.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal
CVE: CVE-2024-44587
Published: 2024-09-05
Description: itsourcecode Alton Management System 1.0 is vulnerable to SQL Injection in /noncombo_save.php via the "menu" parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Lejeremiah/excavation/blob/main/cms-sql1.md
CVE: CVE-2024-45173
Published: 2024-09-05
Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo without having to enter the root password. These commands, for example, include cp, chown, and chmod, which enable an attacker to modify the system's sudoers file in order to execute all commands with root privileges. Thus, it is possible to escalate the limited privileges of the user www-data to root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-027.txt; https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030; http://seclists.org/fulldisclosure/2024/Sep/20
CVE: CVE-2024-45178
Published: 2024-09-05
Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, due to insufficient user input validation. For instance, the download functionality for backups provided by the script download-bkf.pml is vulnerable to a path traversal attack via the parameter bkf. This enables an authenticated user to download arbitrary files as Linux user www-data from the C-MOR system. Another path traversal attack is in the script show-movies.pml, which can be exploited via the parameter cam.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-025.txt; https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030; http://seclists.org/fulldisclosure/2024/Sep/18
CVE: CVE-2024-8445
Published: 2024-09-05
Description: The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2024:7434; https://access.redhat.com/security/cve/CVE-2024-8445; https://bugzilla.redhat.com/show_bug.cgi?id=2310110
CVE: CVE-2023-51712
Published: 2024-09-05
Description: An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.
CVSS Score: 4.7 (MEDIUM)
References: https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/; https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/debug_log_vulnerability.html
CVE: CVE-2024-42885
Published: 2024-09-05
Description: SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp page.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://supervisor0.notion.site/ESAFENET-CDG-SQL-Injection-17d7e244810147f697c3c42a884f932b
CVE: CVE-2024-45096
Published: 2024-09-05
Description: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-548
References: https://www.ibm.com/support/pages/node/7167255
CVE: CVE-2024-45097
Published: 2024-09-05
Description: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-650, CWE-436
References: https://www.ibm.com/support/pages/node/7167255
CVE: CVE-2024-45098
Published: 2024-09-05
Description: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-650
References: https://www.ibm.com/support/pages/node/7167255
CVE: CVE-2024-45171
Published: 2024-09-05
Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup files allows an authenticated user to upload arbitrary files. The only condition is that the filename contains a .cbkf string. Therefore, webshell.cbkf.php is considered a valid file name for the C-MOR web application. Uploaded files are stored within the directory "/srv/www/backups" on the C-MOR system, and can thus be accessed via the URL https://<HOST>/backup/upload_<FILENAME>. Due to broken access control, low-privileged authenticated users can also use this file upload functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-026.txt; https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030; http://seclists.org/fulldisclosure/2024/Sep/19
CVE: CVE-2024-45175
Published: 2024-09-05
Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an attacker with filesystem access, for example exploiting a path traversal attack, has access to the login data of all configured cameras, or the configured FTP server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-312
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-028.txt; https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030; http://seclists.org/fulldisclosure/2024/Sep/21
CVE: CVE-2024-45176
Published: 2024-09-05
Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cross-site scripting (XSS) attacks. It was found out that different functions are prone to reflected cross-site scripting attacks due to insufficient user input validation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-020.txt; https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030; http://seclists.org/fulldisclosure/2024/Sep/8
CVE: CVE-2024-45589
Published: 2024-09-05
Description: RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://benrogozinski.github.io/CVE-2024-45589/; https://help.rapididentity.com/docs/rapididentity-lts-release-notes
CVE: CVE-2024-24759
Published: 2024-09-05
Description: MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12b; https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xr
CVE: CVE-2024-44727
Published: 2024-09-05
Description: Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/AslamMahi/CVE-Aslam-Mahi/blob/main/Sourcecodehero%20Event%20Management%20System/CVE-2024-44727.MD
CVE: CVE-2024-44728
Published: 2024-09-05
Description: Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /clientdetails/admin/regester.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/AslamMahi/CVE-Aslam-Mahi/blob/main/Sourcecodehero%20Event%20Management%20System/CVE-2024-44728.md
CVE: CVE-2024-45392
Published: 2024-09-05
Description: SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_5; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-8qfx-h7pm-2587
CVE: CVE-2024-42491
Published: 2024-09-05
Description: Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-252, CWE-476
References: https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4; https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742; https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2
CVE: CVE-2024-45401
Published: 2024-09-05
Description: stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3 where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags can overwrite arbitrary files. The update in version 1.21.3 addresses the path traversal vulnerability by removing the ability to install plugins from an archive URL or path. There has been no evidence of exploitation of this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/stripe/stripe-cli/security/advisories/GHSA-fv4g-gwpj-74gr
CVE: CVE-2024-7591
Published: 2024-09-05
Description: Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects:

* LoadMaster: 7.2.40.0 and above

* ECS: All versions

* Multi-Tenancy: 7.1.35.4 and above
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://insinuator.net/2024/11/vulnerability-disclosure-command-injection-in-kemp-loadmaster-load-balancer-cve-2024-7591; https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]9613-LoadMaster-Security-Vulnerability-CVE-2024-7591
CVE: CVE-2024-45157
Published: 2024-09-05
Description: An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-696
References: https://github.com/Mbed-TLS/mbedtls/releases/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-1/
CVE: CVE-2024-45158
Published: 2024-09-05
Description: An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://github.com/Mbed-TLS/mbedtls/releases/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-2/
CVE: CVE-2024-45159
Published: 2024-09-05
Description: An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication would nonetheless be able to use it for TLS client authentication. Only TLS 1.3 servers were affected, and only with optional authentication (with required authentication, the handshake would be aborted with a fatal alert).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295, CWE-295
References: https://github.com/Mbed-TLS/mbedtls/releases/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-3/
CVE: CVE-2024-8395
Published: 2024-09-05
Description: FlyCASS CASS and KCM systems did not correctly filter SQL queries, which
 made them vulnerable to attack by outside attackers with no 
authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://ian.sh/tsa
CVE: CVE-2024-39278
Published: 2024-09-05
Description: Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configuration information and terminal configuration data.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-249-01
CVE: CVE-2024-42495
Published: 2024-09-05
Description: Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to network configuration information and terminal configuration data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-249-01
CVE: CVE-2024-45400
Published: 2024-09-06
Description: ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possibility to open a link in a new tab. A vulnerability in versions of the plugin prior to 1.0.7 allowed a user to execute JavaScript code by abusing the link href attribute. The fix is available starting with version 1.0.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/mlewand/ckeditor-plugin-openlink/commit/402391fdd4d9cfd079031372f9caebbf54993ffb; https://github.com/mlewand/ckeditor-plugin-openlink/security/advisories/GHSA-qj47-6x6q-m3c9