deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-24213
Published: 2024-02-08
Description: Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://app.flows.sh:8443/project/default%2C; https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213; https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer.
CVE: CVE-2024-24321
Published: 2024-02-08
Description: An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://dir-816a2.com; https://github.com/dkjiayu/Vul/blob/main/DIR816A2-dir_setWanWifi.md; https://www.dlink.com/
CVE: CVE-2024-22795
Published: 2024-02-08
Description: Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status component.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269, CWE-269
References: https://gist.github.com/Hagrid29/aea0dc35a1e87813dbbb7b317853d023; https://github.com/Hagrid29/ForeScout-SecureConnector-EoP; https://www.forescout.com/
CVE: CVE-2024-23764
Published: 2024-02-08
Description: Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, WithSecure Email and Server Security 15 and later, and WithSecure Elements Endpoint Protection 17 and later.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories/cve-2024-23764; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2024-24215
Published: 2024-02-08
Description: An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information via a crafted POST request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24215; https://reference3.example.com//1.222.228.4/%2C; https://reference4.example.com
CVE: CVE-2024-0242
Published: 2024-02-08
Description: Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings.
CVSS Score: 7.3 (HIGH)
CWE: CWE-200
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-039-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-24-039-01
CVE: CVE-2024-1329
Published: 2024-02-08
Description: HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14.
CVSS Score: 7.7 (HIGH)
CWE: CWE-59, CWE-610
References: https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack; https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack
CVE: CVE-2024-22836
Published: 2024-02-08
Description: An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://akaunting.com/; https://github.com/akaunting/akaunting/releases/tag/3.1.4; https://github.com/u32i/cve/tree/main/CVE-2024-22836
CVE: CVE-2024-23660
Published: 2024-02-08
Description: The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 2023. An attacker can systematically generate mnemonics for each timestamp within an applicable timeframe, and link them to specific wallet addresses in order to steal funds from those wallets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338, CWE-338
References: https://milksad.info/posts/research-update-5/; https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln/; https://milksad.info/posts/research-update-5/
CVE: CVE-2024-24115
Published: 2024-02-08
Description: A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://mechaneus.github.io/CVE-2024-24115.html; https://mechaneus.github.io/CVE-2024-24115.html
CVE: CVE-2024-23756
Published: 2024-02-08
Description: The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.
CVSS Score: 7.5 (HIGH)
References: https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23756; https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23756
CVE: CVE-2024-24494
Published: 2024-02-08
Description: Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/DailyHabitTracker-Stored_XSS.md; https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/DailyHabitTracker-Stored_XSS.md
CVE: CVE-2024-24495
Published: 2024-02-08
Description: SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/DailyHabitTracker-SQL_Injection.md; https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/DailyHabitTracker-SQL_Injection.md
CVE: CVE-2024-24496
Published: 2024-02-08
Description: An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-284, CWE-287
References: https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/DailyHabitTracker-Broken_Access_Control.md; https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/DailyHabitTracker-Broken_Access_Control.md
CVE: CVE-2024-24497
Published: 2024-02-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1009. Reason: This candidate is a duplicate of CVE-2024-1009. Notes: All CVE users should reference CVE-2024-1009 instead of this candidate.
CVE: CVE-2024-24498
Published: 2024-02-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1008. Reason: This candidate is a duplicate of CVE-2024-1008. Notes: All CVE users should reference CVE-2024-1008 instead of this candidate.
CVE: CVE-2024-24499
Published: 2024-02-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1007. Reason: This candidate is a duplicate of CVE-2024-1007. Notes: All CVE users should reference CVE-2024-1007 instead of this candidate.
CVE: CVE-2023-25365
Published: 2024-02-08
Description: Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3
CVSS Score: 7.8 (HIGH)
CWE: CWE-434, CWE-79, CWE-434
References: https://cupc4k3.medium.com/cve-2023-25365-xss-via-file-upload-bypass-ddf4d2a106a7; https://cupc4k3.medium.com/cve-2023-25365-xss-via-file-upload-bypass-ddf4d2a106a7
CVE: CVE-2023-27001
Published: 2024-02-08
Description: An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resulting in privilege escalation.
CVSS Score: 8.8 (HIGH)
References: https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-27001.pdf; https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2023-27001.pdf
CVE: CVE-2023-40265
Published: 2024-02-08
Description: An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://networks.unify.com/security/advisories/OBSO-2305-03.pdf; https://networks.unify.com/security/advisories/OBSO-2305-03.pdf
CVE: CVE-2023-40266
Published: 2024-02-08
Description: An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://networks.unify.com/security/advisories/OBSO-2305-03.pdf; https://networks.unify.com/security/advisories/OBSO-2305-03.pdf
CVE: CVE-2023-49101
Published: 2024-02-08
Description: WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.axigen.com/kb/show/400; https://www.axigen.com/kb/show/400
CVE: CVE-2024-24393
Published: 2024-02-08
Description: File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/zyx0814/Pichome/issues/24; https://github.com/zyx0814/Pichome/issues/24
CVE: CVE-2022-0931
Published: 2024-02-08
Description: Rejected reason: Red Hat Product Security does not consider this to be a vulnerability. Upstream has not acknowledged this issue as a security flaw.
CVE: CVE-2023-40262
Published: 2024-02-08
Description: An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site Scripting (XSS) in the administration component via Access Request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://networks.unify.com/security/advisories/OBSO-2305-02.pdf; https://networks.unify.com/security/advisories/OBSO-2305-02.pdf
CVE: CVE-2023-40263
Published: 2024-02-08
Description: An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2305-02.pdf; https://networks.unify.com/security/advisories/OBSO-2305-02.pdf
CVE: CVE-2023-40264
Published: 2024-02-08
Description: An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated path traversal in the user interface.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://networks.unify.com/security/advisories/OBSO-2305-02.pdf; https://networks.unify.com/security/advisories/OBSO-2305-02.pdf
CVE: CVE-2023-47131
Published: 2024-02-08
Description: The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://me.n-able.com/s/security-advisory/aArHs000000M8CCKA0/cve202347131-passportal-browser-extension-logs-sensitive-data; https://me.n-able.com/s/security-advisory/aArHs000000M8CCKA0/cve202347131-passportal-browser-extension-logs-sensitive-data
CVE: CVE-2023-47132
Published: 2024-02-08
Description: An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://me.n-able.com/s/security-advisory/aArHs000000M8CHKA0/cve202347132-ncentral-api-privilege-escalation; https://me.n-able.com/s/security-advisory/aArHs000000M8CHKA0/cve202347132-ncentral-api-privilege-escalation
CVE: CVE-2023-51630
Published: 2024-02-08
Description: Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Paessler PRTG Network Monitor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the web console. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-21182.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.zerodayinitiative.com/advisories/ZDI-24-073/; https://www.zerodayinitiative.com/advisories/ZDI-24-073/
CVE: CVE-2024-24830
Published: 2024-02-08
Description: OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any authenticated regular user ('member') to add new users with elevated privileges, including the 'root' role, to an organization. This issue circumvents the intended security controls for role assignments. The vulnerability resides in the user creation process, where the payload does not validate the user roles. A regular user can manipulate the payload to assign root-level privileges. This vulnerability leads to Unauthorized Privilege Escalation and significantly compromises the application's role-based access control system. It allows unauthorized control over application resources and poses a risk to data security. All users, particularly those in administrative roles, are impacted. This issue has been addressed in release version 0.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269, CWE-272, CWE-284, CWE-285, CWE-287
References: https://github.com/openobserve/openobserve/security/advisories/GHSA-hfxx-g56f-8h5v; https://github.com/openobserve/openobserve/security/advisories/GHSA-hfxx-g56f-8h5v
CVE: CVE-2024-25106
Published: 2024-02-08
Description: OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any authenticated user within an organization to remove any other user from that same organization, irrespective of their respective roles. This includes the ability to remove users with "Admin" and "Root" roles. By enabling any organizational member to unilaterally alter the user base, it opens the door to unauthorized access and can cause considerable disruptions in operations. The core of the vulnerability lies in the `remove_user_from_org` function in the user management system. This function is designed to allow organizational users to remove members from their organization. The function does not check if the user initiating the request has the appropriate administrative privileges to remove a user. Any user who is part of the organization, irrespective of their role, can remove any other user, including those with higher privileges. This vulnerability is categorized as an Authorization issue leading to Unauthorized User Removal. The impact is severe, as it compromises the integrity of user management within organizations. By exploiting this vulnerability, any user within an organization, without the need for administrative privileges, can remove critical users, including "Admins" and "Root" users. This could result in unauthorized system access, administrative lockout, or operational disruptions. Given that user accounts are typically created by "Admins" or "Root" users, this vulnerability can be exploited by any user who has been granted access to an organization, thereby posing a critical risk to the security and operational stability of the application. This issue has been addressed in release version 0.8.0. Users are advised to upgrade.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269, CWE-272, CWE-284, CWE-285, CWE-287
References: https://github.com/openobserve/openobserve/security/advisories/GHSA-3m5f-9m66-xgp7; https://github.com/openobserve/openobserve/security/advisories/GHSA-3m5f-9m66-xgp7
CVE: CVE-2024-25107
Published: 2024-02-08
Description: WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used when making the human-readable timestamp for inclusion on the wiki_creation column. This function uses interface messages to translate the names of months and days. It uses the `->text()` output mode, returning unescaped interface messages. Since the output is not escaped later, the unescaped interface message is included on the output, resulting in an XSS vulnerability. Exploiting this on-wiki requires the `(editinterface)` right. This vulnerability has been addressed in commit `267e763a0`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/miraheze/WikiDiscover/commit/267e763a0d7460f001693c42f67717a0fc3fd6bb; https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-cfcf-94jv-455f; https://issue-tracker.miraheze.org/T11814
CVE: CVE-2024-24820
Published: 2024-02-09
Description: Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery (CSRF). It enables attackers to perform changes in the monitoring environment managed by Icinga Director without the awareness of the victim. Users of the map module in version 1.x, should immediately upgrade to v2.0. The mentioned XSS vulnerabilities in Icinga Web are already fixed as well and upgrades to the most recent release of the 2.9, 2.10 or 2.11 branch must be performed if not done yet. Any later major release is also suitable. Icinga Director will receive minor updates to the 1.8, 1.9, 1.10 and 1.11 branches to remedy this issue. Upgrade immediately to a patched release. If that is not feasible, disable the director module for the time being.
CVSS Score: 8.3 (HIGH)
CWE: CWE-352, CWE-352
References: https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/; https://github.com/Icinga/icingaweb2-module-director/security/advisories/GHSA-3mwp-5p5v-j6q3; https://github.com/Icinga/icingaweb2/issues?q=is%3Aissue++is%3Aclosed+4979+4960+4947
CVE: CVE-2024-24821
Published: 2024-02-09
Description: Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide lateral user movement or malicious code execution when Composer is invoked within a directory with tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer on untrusted projects, Shared environments with developers who run Composer individually on the same project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the patched versions are applied at the earliest convenience. Where not possible, the following should be addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and avoid running Composer within an untrusted directory, or if needed, verify that the contents of `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code.  A reset can also be done on these files by the following:```sh
rm vendor/composer/installed.php vendor/composer/InstalledVersions.php
composer install --no-scripts --no-plugins
```
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5; https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h; https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5
CVE: CVE-2024-24825
Published: 2024-02-09
Description: DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c; https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-59qj-jcjv-662j; https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c
CVE: CVE-2024-24829
Published: 2024-02-09
Description: Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration (maintained by Sentry) with version <=24.1.1 contains a constrained SSRF vulnerability. An attacker could make Sentry send POST HTTP requests to arbitrary URLs (including internal IP addresses) by providing an unsanitized input to the Phabricator integration. However, the body payload is constrained to a specific format. If an attacker has access to a Sentry instance, this allows them to: 1. interact with internal network; 2. scan local/remote ports. This issue has been fixed in Sentry self-hosted release 24.1.2, and has already been mitigated on sentry.io on February 8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/getsentry/self-hosted/releases/tag/24.1.2; https://github.com/getsentry/sentry/pull/64882; https://github.com/getsentry/sentry/security/advisories/GHSA-rqxh-fp9p-p98r
CVE: CVE-2023-32341
Published: 2024-02-09
Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption.  IBM X-Force ID:  255827.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/255827; https://www.ibm.com/support/pages/node/7116081; https://exchange.xforce.ibmcloud.com/vulnerabilities/255827
CVE: CVE-2023-42016
Published: 2024-02-09
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.  IBM X-Force ID:  265559.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-614, CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265559; https://www.ibm.com/support/pages/node/7116083; https://exchange.xforce.ibmcloud.com/vulnerabilities/265559