deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46778
Published: 2023-11-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <= 2.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/auto-limit-posts-reloaded/wordpress-auto-limit-posts-reloaded-plugin-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/auto-limit-posts-reloaded/wordpress-auto-limit-posts-reloaded-plugin-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-46779
Published: 2023-11-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/easyrecipe/wordpress-easyrecipe-plugin-3-5-3251-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easyrecipe/wordpress-easyrecipe-plugin-3-5-3251-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-46780
Published: 2023-11-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alter plugin <= 1.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/alter/wordpress-alter-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/alter/wordpress-alter-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-46781
Published: 2023-11-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <= 1.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/current-menu-item-for-custom-post-types/wordpress-current-menu-item-for-custom-post-types-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/current-menu-item-for-custom-post-types/wordpress-current-menu-item-for-custom-post-types-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-47186
Published: 2023-11-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/kadence-woocommerce-email-designer/wordpress-kadence-woocommerce-email-designer-plugin-1-5-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kadence-woocommerce-email-designer/wordpress-kadence-woocommerce-email-designer-plugin-1-5-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-5823
Published: 2023-11-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/tk-google-fonts/wordpress-tk-google-fonts-gdpr-compliant-plugin-2-2-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tk-google-fonts/wordpress-tk-google-fonts-gdpr-compliant-plugin-2-2-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-3246
Published: 2023-11-06
Description: An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/415371; https://hackerone.com/reports/2014157; https://gitlab.com/gitlab-org/gitlab/-/issues/415371
CVE: CVE-2023-3399
Published: 2023-11-06
Description: An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.
CVSS Score: 8.5 (HIGH)
CWE: CWE-201
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416244; https://hackerone.com/reports/2021616; https://gitlab.com/gitlab-org/gitlab/-/issues/416244
CVE: CVE-2023-3909
Published: 2023-11-06
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/418763; https://hackerone.com/reports/2050269; https://gitlab.com/gitlab-org/gitlab/-/issues/418763
CVE: CVE-2023-45161
Published: 2023-11-06
Description: The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients.

To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-URLResponseTime instruction to v20.1 by uploading it through the 1E Platform instruction upload UI
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20
References: https://exchange.1e.com/product-packs/network/; https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2003/; https://exchange.1e.com/product-packs/network/
CVE: CVE-2023-45163
Published: 2023-11-06
Description: The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients.

To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-CommandLinePing instruction to v18.1 by uploading it through the 1E Platform instruction upload UI
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20
References: https://exchange.1e.com/product-packs/network/; https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2005/; https://https://exchange.1e.com/product-packs/network/
CVE: CVE-2023-4910
Published: 2023-11-06
Description: A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://access.redhat.com/security/cve/CVE-2023-4910; https://bugzilla.redhat.com/show_bug.cgi?id=2238498; https://access.redhat.com/security/cve/CVE-2023-4910
CVE: CVE-2023-5963
Published: 2023-11-06
Description: An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators.
CVSS Score: 3.1 (LOW)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/423468; https://gitlab.com/gitlab-org/gitlab/-/issues/423468
CVE: CVE-2023-5964
Published: 2023-11-06
Description: The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients.

To remediate this issue DELETE the instruction “Show dialogue with caption %Caption% and message %Message%” from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as “Show %Type% type notification with header %Header% and message %Message%” with a version of 7.1 or above.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20
References: https://exchange.1e.com/product-packs/end-user-interaction/; https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2006/; https://exchange.1e.com/product-packs/end-user-interaction/
CVE: CVE-2023-5950
Published: 2023-11-06
Description: Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).


CVSS Score: 8.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0; https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0
CVE: CVE-2023-41378
Published: 2023-11-06
Description: In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.

CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-703, CWE-755
References: https://github.com/projectcalico/calico/pull/7908; https://github.com/projectcalico/calico/pull/7993; https://www.tigera.io/security-bulletins-tta-2023-001/
CVE: CVE-2023-5678
Published: 2023-11-06
Description: Issue summary: Generating excessively long X9.42 DH keys or checking
excessively long X9.42 DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_generate_key() to
generate an X9.42 DH key may experience long delays.  Likewise, applications
that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
Where the key or parameters that are being checked have been obtained from
an untrusted source this may lead to a Denial of Service.

While DH_check() performs all the necessary checks (as of CVE-2023-3817),
DH_check_pub_key() doesn't make any of these checks, and is therefore
vulnerable for excessively large P and Q parameters.

Likewise, while DH_generate_key() performs a check for an excessively large
P, it doesn't check for an excessively large Q.

An application that calls DH_generate_key() or DH_check_pub_key() and
supplies a key or parameters obtained from an untrusted source could be
vulnerable to a Denial of Service attack.

DH_generate_key() and DH_check_pub_key() are also called by a number of
other OpenSSL functions.  An application calling any of those other
functions may similarly be affected.  The other functions affected by this
are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().

Also vulnerable are the OpenSSL pkey command line application when using the
"-pubcheck" option, as well as the OpenSSL genpkey command line application.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-606, CWE-754
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017
CVE: CVE-2023-5967
Published: 2023-11-06
Description: Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5968
Published: 2023-11-06
Description: Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. 


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-116
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5969
Published: 2023-11-06
Description: Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-40660
Published: 2023-11-06
Description: A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://access.redhat.com/errata/RHSA-2023:7876; https://access.redhat.com/errata/RHSA-2023:7879; https://access.redhat.com/security/cve/CVE-2023-40660
CVE: CVE-2023-40661
Published: 2023-11-06
Description: Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow 
compromise key generation, certificate loading, and other card management operations during enrollment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://access.redhat.com/errata/RHSA-2023:7876; https://access.redhat.com/errata/RHSA-2023:7879; https://access.redhat.com/security/cve/CVE-2023-40661
CVE: CVE-2023-4535
Published: 2023-11-06
Description: An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2023:7879; https://access.redhat.com/security/cve/CVE-2023-4535; https://bugzilla.redhat.com/show_bug.cgi?id=2240914
CVE: CVE-2023-44398
Published: 2023-11-06
Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ affected. The out-of-bounds write is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. This bug is fixed in version v0.28.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/Exiv2/exiv2/commit/e884a[PII_REDACTED]f4031c74a07406df7e99929a5; https://github.com/Exiv2/exiv2/security/advisories/GHSA-hrw9-ggg3-3r4r; https://security.gentoo.org/glsa/202312-06
CVE: CVE-2023-45827
Published: 2023-11-06
Description: Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.

CVSS Score: 7.3 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/clickbar/dot-diver/commit/98daf567390d816fd378ec998eefe2e97f293d5a; https://github.com/clickbar/dot-diver/security/advisories/GHSA-9w5f-mw3p-pj47; https://github.com/clickbar/dot-diver/commit/98daf567390d816fd378ec998eefe2e97f293d5a
CVE: CVE-2023-46251
Published: 2023-11-06
Description:  MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP → Configuration → Settings → Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP → Your Profile → Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP → Configuration → Settings_):
- _Clickable Smilies and BB Code → [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP → Your Profile → Edit Options_) _Show the MyCode formatting options on the posting pages_.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276; https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8; https://mybb.com/versions/1.8.37/
CVE: CVE-2023-46728
Published: 2023-11-06
Description: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/squid-cache/squid/commit/6ea12e8fb590ac6959e9356a81aa[PII_REDACTED]c3; https://github.com/squid-cache/squid/security/advisories/GHSA-cg5h-v6vc-w33f; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
CVE: CVE-2023-4700
Published: 2023-11-06
Description: An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/421937; https://hackerone.com/reports/2129826; https://gitlab.com/gitlab-org/gitlab/-/issues/421937
CVE: CVE-2023-39345
Published: 2023-11-06
Description: strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.6 (HIGH)
CWE: CWE-287
References: https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2; https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2
CVE: CVE-2023-46254
Published: 2023-11-06
Description: capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccount tenant owners the right to list Namespaces of other tenants backed by the same owner kind and name. For example consider two tenants `solar` and `wind`. Tenant `solar`, owned by a ServiceAccount named `tenant-owner` in the Namespace `solar`. Tenant `wind`, owned by a ServiceAccount named `tenant-owner` in the Namespace `wind`. The Tenant owner `solar` would be able to list the namespaces of the Tenant `wind` and vice-versa, although this is not correct. The bug introduces an exfiltration vulnerability since allows the listing of Namespace resources of other Tenants, although just in some specific conditions: 1. `capsule-proxy` runs with the `--disable-caching=false` (default value: `false`) and 2. Tenant owners are ServiceAccount, with the same resource name, but in different Namespaces. This vulnerability doesn't allow any privilege escalation on the outer tenant Namespace-scoped resources, since the Kubernetes RBAC is enforcing this. This issue has been addressed in version 0.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/projectcapsule/capsule-proxy/commit/615202f7b02eaec7681336bd63daed1f39ae00c5; https://github.com/projectcapsule/capsule-proxy/security/advisories/GHSA-6758-979h-249x; https://github.com/projectcapsule/capsule-proxy/commit/615202f7b02eaec7681336bd63daed1f39ae00c5
CVE: CVE-2023-46731
Published: 2023-11-06
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL parameter that is used in the code for displaying administration sections. This allows any user with read access to the document `XWiki.AdminSheet` (by default, everyone including unauthenticated users) to execute code including Groovy code. This impacts the confidentiality, integrity and availability of the whole XWiki instance. This vulnerability has been patched in XWiki 14.10.14, 15.6 RC1 and 15.5.1. Users are advised to upgrade. Users unablr to upgrade may apply the fix in commit `fec8e0e53f9` manually. Alternatively, to protect against attacks from unauthenticated users, view right for guests can be removed from this document (it is only needed for space and wiki admins).
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94, CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/fec8e0e53f9fa2c3f1e568cc15b0e972727c803a; https://github.com/xwiki/xwiki-platform/commit/fec8e0e53f9fa2c3f1e568cc15b0e972727c803a#diff-6271f9be501f30b2ba55459eb451aee3413d34171ba8198a77c865306d174e23; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-62pr-qqf7-hh89