deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24414
Published: 2021-10-25
Description: The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/e20b805d-eb11-4702-9803-77de276000ac; https://wpscan.com/vulnerability/e20b805d-eb11-4702-9803-77de276000ac
CVE: CVE-2021-24485
Published: 2021-10-25
Description: The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/4a6b278a-4c11-4624-86bf[PII_REDACTED]43; https://wpscan.com/vulnerability/4a6b278a-4c11-4624-86bf[PII_REDACTED]43
CVE: CVE-2021-24487
Published: 2021-10-25
Description: The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/def352f8-1bbe-4263-ad1a[PII_REDACTED]f4; https://wpscan.com/vulnerability/def352f8-1bbe-4263-ad1a[PII_REDACTED]f4
CVE: CVE-2021-24489
Published: 2021-10-25
Description: The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c; https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c
CVE: CVE-2021-24514
Published: 2021-10-25
Description: The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/0afa78d3-2403-4e0c-8f16-5b7874b03cd2; https://wpscan.com/vulnerability/0afa78d3-2403-4e0c-8f16-5b7874b03cd2
CVE: CVE-2021-24515
Published: 2021-10-25
Description: The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/6bbea7fe-e966-406b-ad06-0206fcc6f0a0; https://wpscan.com/vulnerability/6bbea7fe-e966-406b-ad06-0206fcc6f0a0
CVE: CVE-2021-24543
Published: 2021-10-25
Description: The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/aa23f743-811b-4fd1-81a9-42916342e312; https://wpscan.com/vulnerability/aa23f743-811b-4fd1-81a9-42916342e312
CVE: CVE-2021-24544
Published: 2021-10-25
Description: The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/4a2dddfc-6ce2-4edd-aaaa-4c130a9356d0; https://wpscan.com/vulnerability/4a2dddfc-6ce2-4edd-aaaa-4c130a9356d0
CVE: CVE-2021-24608
Published: 2021-10-25
Description: The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2609911; https://wpscan.com/vulnerability/75305ea8-730b-4caf-a3c6-cb94adee683c; https://plugins.trac.wordpress.org/changeset/2609911
CVE: CVE-2021-24653
Published: 2021-10-25
Description: The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/bfa8f46f-d323-4a2d-b875-39cd9b4cee0a; https://wpscan.com/vulnerability/bfa8f46f-d323-4a2d-b875-39cd9b4cee0a
CVE: CVE-2021-24662
Published: 2021-10-25
Description: The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/8a74a2a0-3d8c-427f-9a83-0160d652c5f0; https://wpscan.com/vulnerability/8a74a2a0-3d8c-427f-9a83-0160d652c5f0
CVE: CVE-2021-24699
Published: 2021-10-25
Description: The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/4f5c3f75-0501-4a1a-95ea-cbfd3fc96852; https://wpscan.com/vulnerability/4f5c3f75-0501-4a1a-95ea-cbfd3fc96852
CVE: CVE-2021-24744
Published: 2021-10-25
Description: The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/702a4283-1fd6-4186-9db7-6ad387d714ea; https://wpscan.com/vulnerability/702a4283-1fd6-4186-9db7-6ad387d714ea
CVE: CVE-2021-24769
Published: 2021-10-25
Description: The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/a2f211af-5373-425f-9964-ebbf5efde87b; https://wpscan.com/vulnerability/a2f211af-5373-425f-9964-ebbf5efde87b
CVE: CVE-2021-24774
Published: 2021-10-25
Description: The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/f80ef09a-d3e2-4d62-8532-f0ebe59ae110; https://wpscan.com/vulnerability/f80ef09a-d3e2-4d62-8532-f0ebe59ae110
CVE: CVE-2021-24779
Published: 2021-10-25
Description: The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-352, CWE-862
References: https://wpscan.com/vulnerability/8d0e65ee-fdd1-4fd6-9a27-01664c703d90; https://wpscan.com/vulnerability/8d0e65ee-fdd1-4fd6-9a27-01664c703d90
CVE: CVE-2021-24785
Published: 2021-10-25
Description: The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/3957056c-df25-41f7-ab0d-1d09222f2fa5; https://wpscan.com/vulnerability/3957056c-df25-41f7-ab0d-1d09222f2fa5
CVE: CVE-2021-24884
Published: 2021-10-25
Description: The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79, CWE-352
References: https://github.com/S1lkys/XSS-in-Formidable-4.09.04/blob/main/XSS-in-Formidable-4.09.04.pdf; https://github.com/Strategy11/formidable-forms/pull/335/files; https://wpscan.com/vulnerability/b57dacdd-43c2-48f8-ac1e-eb8306b22533
CVE: CVE-2021-24885
Published: 2021-10-25
Description: The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2227747/; https://wpscan.com/vulnerability/d0b312f8-8b16-45be-b5e5-bf9d4b3e9b1e; https://plugins.trac.wordpress.org/changeset/2227747/
CVE: CVE-2020-20908
Published: 2021-10-25
Description: Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Company Name input field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/154691/Akaunting-1.3.17-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/154691/Akaunting-1.3.17-Cross-Site-Scripting.html
CVE: CVE-2021-41035
Published: 2021-10-25
Description: In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-250, CWE-440
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=576395; https://github.com/eclipse-openj9/openj9/pull/13740; https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/104
CVE: CVE-2021-21319
Published: 2021-10-25
Description: Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugs.galette.eu/issues/1535; https://github.com/galette/galette/commit/514418da973ae5b84bf97f94bd288a41e8e3f0a6; https://github.com/galette/galette/commit/8f3bdd9f7d0708466e011253064a867ca2b271a5
CVE: CVE-2021-37624
Published: 2021-10-25
Description: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing. By default, SIP requests of the type MESSAGE (RFC 3428) are not authenticated in the affected versions of FreeSWITCH. MESSAGE requests are relayed to SIP user agents registered with the FreeSWITCH server without requiring any authentication. Although this behaviour can be changed by setting the `auth-messages` parameter to `true`, it is not the default setting. Abuse of this security issue allows attackers to send SIP MESSAGE messages to any SIP user agent that is registered with the server without requiring authentication. Additionally, since no authentication is required, chat messages can be spoofed to appear to come from trusted entities. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. This issue is patched in version 1.10.7. Maintainers recommend that this SIP message type is authenticated by default so that FreeSWITCH administrators do not need to be explicitly set the `auth-messages` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-306
References: http://packetstormsecurity.com/files/164628/FreeSWITCH-1.10.6-Missing-SIP-MESSAGE-Authentication.html; http://seclists.org/fulldisclosure/2021/Oct/44; http://www.openwall.com/lists/oss-security/2021/10/25/6
CVE: CVE-2021-34854
Published: 2021-10-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13544.
CVSS Score: 7.8 (HIGH)
CWE: CWE-789, CWE-770
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-937/; https://kb.parallels.com/125013
CVE: CVE-2021-34855
Published: 2021-10-25
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13592.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-939/; https://kb.parallels.com/125013
CVE: CVE-2021-34856
Published: 2021-10-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the virtio-gpu virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13581.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-938/; https://kb.parallels.com/125013
CVE: CVE-2021-34857
Published: 2021-10-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13601.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-940/; https://kb.parallels.com/125013
CVE: CVE-2021-34859
Published: 2021-10-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TVS files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13697.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://community.teamviewer.com/English/discussion/117794/august-updates-security-patches/p1; https://www.zerodayinitiative.com/advisories/ZDI-21-1003/; https://community.teamviewer.com/English/discussion/117794/august-updates-security-patches/p1
CVE: CVE-2021-34860
Published: 2021-10-25
Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the getpage parameter provided to the webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-12103.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201; https://www.zerodayinitiative.com/advisories/ZDI-21-976/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201
CVE: CVE-2021-34861
Published: 2021-10-25
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the webproc endpoint, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12104.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201; https://www.zerodayinitiative.com/advisories/ZDI-21-977/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201
CVE: CVE-2021-34862
Published: 2021-10-25
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:menu parameter provided to the webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13270.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201; https://www.zerodayinitiative.com/advisories/ZDI-21-978/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201
CVE: CVE-2021-34863
Published: 2021-10-25
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:page parameter provided to the webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13271.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201; https://www.zerodayinitiative.com/advisories/ZDI-21-979/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201
CVE: CVE-2021-34864
Published: 2021-10-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the WinAppHelper component. The issue results from the lack of proper access control. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13543.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.zerodayinitiative.com/advisories/ZDI-21-1000/; https://www.zerodayinitiative.com/advisories/ZDI-21-1000/
CVE: CVE-2021-41176
Published: 2021-10-25
Description: Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/pterodactyl/panel/commit/45999ba4ee1b2dcb12b4a2fa2cedfb6b5d66fac2; https://github.com/pterodactyl/panel/releases/tag/v1.6.3; https://github.com/pterodactyl/panel/security/advisories/GHSA-m49f-hcxp-6hm6
CVE: CVE-2021-39220
Published: 2021-10-25
Description: Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-200, CWE-20
References: https://github.com/nextcloud/mail/pull/5470; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q9v-wm8r-rcv5; https://hackerone.com/reports/1308147