deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-24902
Published: 2022-05-06
Description: TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically lead to performance degradation. There are no known workarounds. This issue has been patched and users are advised to upgrade to version 2.0.0 or later.
CVSS Score: 2.9 (LOW)
CWE: CWE-400, CWE-400
References: https://github.com/PaulleDemon/tkVideoPlayer/issues/3; https://github.com/PaulleDemon/tkVideoPlayer/security/advisories/GHSA-jmhj-vh4q-hhmq; https://github.com/PaulleDemon/tkVideoPlayer/issues/3
CVE: CVE-2022-24903
Published: 2022-05-06
Description: Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-1284
References: https://github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705; https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8; https://lists.debian.org/debian-lts-announce/2022/05/msg00028.html
CVE: CVE-2022-29161
Published: 2022-05-06
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. The problem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 certificates signed by default using SHA256 with RSA. Administrators are advised to upgrade their XWiki installation to one of the patched versions. If the upgrade is not possible, it is possible to patch the module xwiki-platform-crypto in a local installation by applying the change exposed in 26728f3 and re-compiling the module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-327, CWE-326
References: https://github.com/xwiki/xwiki-platform/commit/26728f3f[PII_REDACTED]3667a5182a916c7ecefc52; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h8v5-p258-pqf4; https://jira.xwiki.org/browse/XWIKI-19676
CVE: CVE-2022-29164
Published: 2022-05-06
Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to the Argo Server API (as the victim), so may read information about the victim’s workflows, or create and delete workflows. Note the attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. The attacker must have an understanding of the victim’s system. We have seen no evidence of this in the wild. We urge all users to upgrade to the fixed versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://github.com/argoproj/argo-workflows/commit/87470e1c2bf703a9110e97bb755614ce8757fdcc; https://github.com/argoproj/argo-workflows/pull/8585; https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cmv8-6362-r5w9
CVE: CVE-2022-29171
Published: 2022-05-06
Description: Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service. The Gitolite code host integration with Phabricator allows Sourcegraph site admins to specify a `callsignCommand`, which is used to obtain the Phabricator metadata for a Gitolite repository. An administrator who is able to edit or add a Gitolite code host and has administrative access to Sourcegraph’s bundled Grafana instance can change this command arbitrarily and run it remotely. This grants direct access to the infrastructure underlying the Sourcegraph installation. The attack requires: site-admin privileges on the instance of Sourcegraph, Administrative privileges on the bundled Grafana monitoring instance, Knowledge of the gitserver IP address or DNS name (if running in Kubernetes). This can be found through Grafana. The issue is patched in version 3.38.0. You may disable Gitolite code hosts. We still highly encourage upgrading regardless of workarounds.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-r2m9-hfg8-4c38; https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-r2m9-hfg8-4c38
CVE: CVE-2021-25745
Published: 2022-05-06
Description: A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/kubernetes/ingress-nginx/issues/8502; https://groups.google.com/g/kubernetes-security-announce/c/7vQrpDZeBlc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-25746
Published: 2022-05-06
Description: A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/kubernetes/ingress-nginx/issues/8503; https://groups.google.com/g/kubernetes-security-announce/c/hv2-SfdqcfQ; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-24877
Published: 2022-05-06
Description: Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22, CWE-36, CWE-22
References: https://github.com/fluxcd/flux2/security/advisories/GHSA-j77r-2fxf-5jrw; https://github.com/fluxcd/flux2/security/advisories/GHSA-j77r-2fxf-5jrw
CVE: CVE-2022-24878
Published: 2022-05-06
Description: Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/fluxcd/flux2/security/advisories/GHSA-7pwf-jg34-hxwp; https://github.com/fluxcd/flux2/security/advisories/GHSA-7pwf-jg34-hxwp
CVE: CVE-2022-30293
Published: 2022-05-06
Description: In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2022/05/30/1; https://bugs.webkit.org/show_bug.cgi?id=237187; https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.36.0
CVE: CVE-2022-30294
Published: 2022-05-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-30293. Reason: This candidate is a duplicate of CVE-2022-30293. Notes: All CVE users should reference CVE-2022-30293 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-30295
Published: 2022-05-06
Description: uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330
References: https://www.kb.cert.org/vuls/id/473698; https://www.nozominetworks.com/blog/nozomi-networks-discovers-unpatched-dns-bug-in-popular-c-standard-library-putting-iot-at-risk/; https://www.kb.cert.org/vuls/id/473698
CVE: CVE-2022-24823
Published: 2022-05-06
Description: Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-378, CWE-379, CWE-668, CWE-668
References: https://github.com/netty/netty/commit/185f8b2756a36aaa4f973f1a2a025e7d981823f1; https://github.com/netty/netty/security/advisories/GHSA-269q-hmxg-m83q; https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2
CVE: CVE-2020-19212
Published: 2022-05-06
Description: SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1009; https://github.com/Piwigo/Piwigo/issues/1009
CVE: CVE-2020-19213
Published: 2022-05-06
Description: SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1010; https://github.com/Piwigo/Piwigo/issues/1010
CVE: CVE-2020-19215
Published: 2022-05-06
Description: SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1011; https://github.com/Piwigo/Piwigo/issues/1011
CVE: CVE-2020-19216
Published: 2022-05-06
Description: SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1011; https://github.com/Piwigo/Piwigo/issues/1011
CVE: CVE-2020-19217
Published: 2022-05-06
Description: SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1012; https://github.com/Piwigo/Piwigo/issues/1012
CVE: CVE-2022-28969
Published: 2022-05-06
Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGusetBasic. This vulnerability allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/d1tto/IoT-vuln/tree/main/Tenda/AX1806/fromSetWifiGusetBasic; https://github.com/d1tto/IoT-vuln/tree/main/Tenda/AX1806/fromSetWifiGusetBasic
CVE: CVE-2022-28970
Published: 2022-05-06
Description: Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow via the mac parameter in the function GetParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/d1tto/IoT-vuln/blob/main/Tenda/AX1806/GetParentControlInfo/readme.md; https://github.com/d1tto/IoT-vuln/blob/main/Tenda/AX1806/GetParentControlInfo/readme.md
CVE: CVE-2022-28971
Published: 2022-05-06
Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetIpMacBind. This vulnerability allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/d1tto/IoT-vuln/blob/main/Tenda/AX1806/fromSetIpMacBind/readme.md; https://github.com/d1tto/IoT-vuln/blob/main/Tenda/AX1806/fromSetIpMacBind/readme.md
CVE: CVE-2022-28972
Published: 2022-05-06
Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/d1tto/IoT-vuln/blob/main/Tenda/AX1806/form_fast_setting_wifi_set/readme.md; https://github.com/d1tto/IoT-vuln/blob/main/Tenda/AX1806/form_fast_setting_wifi_set/readme.md
CVE: CVE-2022-28973
Published: 2022-05-06
Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the function fromAdvSetMacMtuWan. This vulnerability allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/d1tto/IoT-vuln/blob/main/Tenda/AX1806/fromAdvSetMacMtuWan/readme.md; https://github.com/d1tto/IoT-vuln/blob/main/Tenda/AX1806/fromAdvSetMacMtuWan/readme.md
CVE: CVE-2022-28005
Published: 2022-05-06
Description: An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server (via /Electron/download directory traversal in conjunction with a path component that uses backslash characters), leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. NOTE: this issue exists because of an incomplete fix for CVE-2022-48482.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88; https://www.3cx.com/blog/change-log/phone-system-change-log/; https://www.3cx.com/blog/releases/v18-security-hotfix/
CVE: CVE-2021-39023
Published: 2022-05-06
Description: IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 213860.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213860; https://www.ibm.com/support/pages/node/6582473; https://exchange.xforce.ibmcloud.com/vulnerabilities/213860
CVE: CVE-2021-39027
Published: 2022-05-06
Description: IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. IBM X-Force ID: 213865.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-116
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213865; https://www.ibm.com/support/pages/node/6582499; https://exchange.xforce.ibmcloud.com/vulnerabilities/213865
CVE: CVE-2022-21934
Published: 2022-05-06
Description: Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.
CVSS Score: 8.0 (HIGH)
CWE: CWE-620, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-125-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/uscert/ics/advisories/icsa-22-125-01
CVE: CVE-2022-28163
Published: 2022-05-06
Description: In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowing an attacker to run arbitrary SQL commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1842; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1842
CVE: CVE-2022-28164
Published: 2022-05-06
Description: Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords. This could allow an authenticated attacker to decrypt stored account passwords.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1843; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1843
CVE: CVE-2021-26253
Published: 2022-05-06
Description: A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-0504.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0504.html
CVE: CVE-2021-31559
Published: 2022-05-06
Description: A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-0503.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0503.html
CVE: CVE-2021-33845
Published: 2022-05-06
Description: The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://research.splunk.com/application/splunk_user_enumeration_attempt/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html; https://research.splunk.com/application/splunk_user_enumeration_attempt/
CVE: CVE-2021-36912
Published: 2022-05-06
Description: Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or higher user role.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/google-news-sitemap/wordpress-andrea-pernici-news-sitemap-for-google-plugin-1-0-16-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/google-news-sitemap/; https://patchstack.com/database/vulnerability/google-news-sitemap/wordpress-andrea-pernici-news-sitemap-for-google-plugin-1-0-16-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-42743
Published: 2022-05-06
Description: A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-0501.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0501.html
CVE: CVE-2022-1053
Published: 2022-05-06
Description: Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1,
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2065024%2C; https://github.com/keylime/keylime/commit/bd5de712acdd77860e7dc58969181e16c7a8dc5d; https://github.com/keylime/keylime/security/advisories/GHSA-jf66-3q76-h5p5%2C
CVE: CVE-2022-26070
Published: 2022-05-06
Description: When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-209
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-0507.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0507.html
CVE: CVE-2022-26889
Published: 2022-05-06
Description: In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to initiate a request within the victim's browser (e.g., phishing).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-22
References: https://research.splunk.com/application/path_traversal_spl_injection/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html; https://research.splunk.com/application/path_traversal_spl_injection/