deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7027
Published: 2024-07-24
Description: The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is due to insufficient verification on the user being supplied during a QR code login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing Voucher Vendor user on the site, if they have access to the user id.
CVSS Score: 7.3 (HIGH)
CWE: CWE-288
References: https://codecanyon.net/item/woocommerce-pdf-vouchers-ultimate-gift-cards-wordpress-plugin/7392046; https://www.wordfence.com/threat-intel/vulnerabilities/id/b6cf27d9-c0be-4cff-8867-19297f6d79d7?source=cve; https://codecanyon.net/item/woocommerce-pdf-vouchers-ultimate-gift-cards-wordpress-plugin/7392046
CVE: CVE-2024-3246
Published: 2024-07-24
Description: The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3123399/litespeed-cache/trunk/src/cloud.cls.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/8036bd83-9af5-4b71-8974-9b0690ea6769?source=cve; https://plugins.trac.wordpress.org/changeset/3123399/litespeed-cache/trunk/src/cloud.cls.php
CVE: CVE-2024-5861
Published: 2024-07-24
Description: The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-easy-pay/trunk/modules/payments/square-authorization.php#L199; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106655%40wp-easy-pay&new=3106655%40wp-easy-pay&sfp_email=&sfph_mail=#file1; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3122946%40wp-easy-pay&new=3122946%40wp-easy-pay&sfp_email=&sfph_mail=
CVE: CVE-2024-40767
Published: 2024-07-24
Description: In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://launchpad.net/bugs/2071734; https://security.openstack.org; https://security.openstack.org/ossa/OSSA-2024-002.html
CVE: CVE-2024-6094
Published: 2024-07-24
Description: The WP ULike  WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/019b3f34-7b85-4728-8dd7-ca472d6b2d06/; https://wpscan.com/vulnerability/019b3f34-7b85-4728-8dd7-ca472d6b2d06/
CVE: CVE-2024-6836
Published: 2024-07-24
Description: The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to update multiple settings, including templates, designs, checkouts, and other plugin settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/funnel-builder/trunk/modules/checkouts/includes/class-wfacp-ajax-controller.php; https://plugins.trac.wordpress.org/changeset/3123202/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d9022afe-0c79-413b-ac0a-a1d32ec09619?source=cve
CVE: CVE-2023-32466
Published: 2024-07-24
Description: Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some UEFI code, leading to arbitrary code execution or escalation of privilege.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200; https://www.dell.com/support/kbdoc/en-us/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200
CVE: CVE-2024-6553
Published: 2024-07-24
Description: The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3117899%40wp-meteor&new=3117899%40wp-meteor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6197c194-5a17-41da-be79-58a6f5c68a0b?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3117899%40wp-meteor&new=3117899%40wp-meteor&sfp_email=&sfph_mail=
CVE: CVE-2024-6571
Published: 2024-07-24
Description: The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3122915%40imageseo&new=3122915%40imageseo&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a11083dd-7a5f-483b-a854-2697ddc54262?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3122915%40imageseo&new=3122915%40imageseo&sfp_email=&sfph_mail=
CVE: CVE-2024-6629
Published: 2024-07-24
Description: The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L74; https://plugins.trac.wordpress.org/changeset/3123171/; https://plugins.trac.wordpress.org/changeset/3123171/all-in-one-video-gallery/trunk/public/video.php
CVE: CVE-2023-32471
Published: 2024-07-24
Description: Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds read vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability to read contents of stack memory and use this information for further exploits.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125
References: https://www.dell.com/support/kbdoc/en-us/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200; https://www.dell.com/support/kbdoc/en-us/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200
CVE: CVE-2023-48362
Published: 2024-07-24
Description: XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file.
Users are recommended to upgrade to version 1.21.2, which fixes this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2024/07/24/3; https://lists.apache.org/thread/9tt0q4bdjwgw0dz0l9knqxjnpb5y6zsl; http://www.openwall.com/lists/oss-security/2024/07/24/3
CVE: CVE-2024-39676
Published: 2024-07-24
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot.

This issue affects Apache Pinot: from 0.1 before 1.0.0.

Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue.

Details: 

When using a request to path “/appconfigs” to the controller, it can lead to the disclosure of sensitive information such as system information (e.g. arch, os version), environment information (e.g. maxHeapSize) and Pinot configurations (e.g. zookeeper path). This issue was addressed by the  Role-based Access Control https://docs.pinot.apache.org/operators/tutorials/authentication/basic-auth-access-control , so that /appConfigs` and all other APIs can be access controlled. Only authorized users have access to it. Note the user needs to add the admin role accordingly to the RBAC guide to control access to this endpoint, and in the future version of Pinot, a default admin role is planned to be added.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://lists.apache.org/thread/hsm0b2w8qr0sqy4rj1mfnnw286tslpzc; http://www.openwall.com/lists/oss-security/2024/07/23/5; https://lists.apache.org/thread/hsm0b2w8qr0sqy4rj1mfnnw286tslpzc
CVE: CVE-2024-3297
Published: 2024-07-24
Description: An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between two devices, as implemented in the Matter protocol versions before Matter 1.1 allows an attacker to replay manipulated CASE Sigma1 messages to make the device unresponsive until the device is power-cycled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://www.bitdefender.com/support/security-advisories/session-establishment-lock-up-during-replay-of-case-sigma1-messages/; https://www.bitdefender.com/support/security-advisories/session-establishment-lock-up-during-replay-of-case-sigma1-messages/
CVE: CVE-2024-3454
Published: 2024-07-24
Description: An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose information about devices part of the same fabric (footprinting), even though the protocol is designed to prevent access to such information.
CVSS Score: 3.5 (LOW)
CWE: CWE-209
References: https://www.bitdefender.com/support/security-advisories/in-fabric-matter-cluster-attribute-disclosure/; https://www.bitdefender.com/support/security-advisories/in-fabric-matter-cluster-attribute-disclosure/
CVE: CVE-2024-6197
Published: 2024-07-24
Description: libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2024/07/24/1; http://www.openwall.com/lists/oss-security/2024/07/24/5; https://curl.se/docs/CVE-2024-6197.html
CVE: CVE-2024-6874
Published: 2024-07-24
Description: libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.

This flaw can lead to stack contents accidently getting returned as part of
the converted string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2024/07/24/2; https://curl.se/docs/CVE-2024-6874.html; https://curl.se/docs/CVE-2024-6874.json
CVE: CVE-2024-6930
Published: 2024-07-24
Description: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/booking/trunk/core/lib/wpdev-booking-class.php#L849; https://plugins.trac.wordpress.org/changeset/3123628/; https://wordpress.org/plugins/booking/#developers
CVE: CVE-2024-7065
Published: 2024-07-24
Description: A vulnerability was found in Spina CMS up to 2.18.0. It has been classified as problematic. Affected is an unknown function of the file /admin/pages/. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272346 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/topsky979/Security-Collections/blob/main/1700810/README.md; https://vuldb.com/?ctiid.272346; https://vuldb.com/?id.272346
CVE: CVE-2024-6896
Published: 2024-07-24
Description: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.96.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.96.1/templates/features.php#L7159; https://plugins.trac.wordpress.org/changeset/3123278/; https://wordpress.org/plugins/accelerated-mobile-pages/#developers
CVE: CVE-2024-7066
Published: 2024-07-24
Description: A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/config_time_sync.php of the component HTTP POST Request Handler. The manipulation of the argument ntp_server leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272347.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://vuldb.com/?ctiid.272347; https://vuldb.com/?id.272347; https://vuldb.com/?submit.378322
CVE: CVE-2024-3896
Published: 2024-07-24
Description: The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery title field in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3100759/robo-gallery; https://www.wordfence.com/threat-intel/vulnerabilities/id/69ab404b-1c2f-441b-8622-3cf830587d95?source=cve; https://plugins.trac.wordpress.org/changeset/3100759/robo-gallery
CVE: CVE-2024-5818
Published: 2024-07-24
Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widget in all versions up to, and including, 1.3.980 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3121073/royal-elementor-addons; https://www.wordfence.com/threat-intel/vulnerabilities/id/83a0150d-a9fa-4cc2-8fe8-a429747a9964?source=cve; https://plugins.trac.wordpress.org/changeset/3121073/royal-elementor-addons
CVE: CVE-2023-45249
Published: 2024-07-24
Description: Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1393
References: https://security-advisory.acronis.com/advisories/SEC-6452; https://www.securityweek.com/acronis-product-vulnerability-exploited-in-the-wild/; https://security-advisory.acronis.com/advisories/SEC-6452
CVE: CVE-2024-6096
Published: 2024-07-24
Description: In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-470, CWE-470
References: https://docs.telerik.com/reporting/knowledge-base/unsafe-reflection-CVE-2024-6096; https://docs.telerik.com/reporting/knowledge-base/unsafe-reflection-CVE-2024-6096; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-6327
Published: 2024-07-24
Description: In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://docs.telerik.com/report-server/knowledge-base/deserialization-vulnerability-cve-2024-6327; https://www.telerik.com/report-server; https://docs.telerik.com/report-server/knowledge-base/deserialization-vulnerability-cve-2024-6327
CVE: CVE-2024-7067
Published: 2024-07-24
Description: A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as critical. Affected by this issue is the function getCartProductsIds of the file app/Cart.php. The manipulation of the argument laraCart leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is a02111a674ab49f65018b31da3011b1e396f59b1. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-272348.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/commit/a02111a674ab49f65018b31da3011b1e396f59b1; https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18; https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18#issuecomment[PII_REDACTED]
CVE: CVE-2024-22443
Published: 2024-07-24
Description: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04672en_us&docLocale=en_US; https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04672en_us&docLocale=en_US
CVE: CVE-2024-31971
Published: 2024-07-24
Description: Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject arbitrary JavaScript, as demonstrated by /mainPassword.html, /processIdentity.html, /public.html, /dhcp.html, /private.html, /hostname.html, /connectivity.html, /NetworkMonitor.html, /trafficMonitoringConfig.html, and /wizardMain.html.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31971; https://github.com/actuator/cve/blob/main/AdTran/NetVanta-3120-XSS; https://supportcommunity.adtran.com/t5/NetVanta-Product-Notices/2019-Q2-NetVanta-3120-3130-EOL/ta-p/35715
CVE: CVE-2024-31977
Published: 2024-07-24
Description: Adtran 834-5 11.1.0[PII_REDACTED]31430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or Traceroute utility.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz; https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977; https://github.com/actuator/cve/tree/main/AdTran/834-5
CVE: CVE-2024-39345
Published: 2024-07-24
Description: AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose password is based on the devices MAC address. All of the devices internet interfaces share a similar MAC address that only varies in their final octet. This allows network-adjacent attackers to derive the support user's SSH password by decrementing the final octet of the connected gateway address or via the BSSID. An attacker can then execute arbitrary OS commands with root-level privileges. NOTE: The vendor states that there is no intended functionality allowing an attacker to execute arbitrary OS Commands with root-level privileges. The vendor also states that this issue was fixed in SmartOS 12.5.5.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-259
References: https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-39345; https://github.com/actuator/cve/blob/main/AdTran/TBA; https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332