deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8181
Published: 2024-08-27
Description: An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://tenable.com/security/research/tra-2024-33
CVE: CVE-2024-8182
Published: 2024-08-27
Description: An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://tenable.com/security/research/tra-2024-34
CVE: CVE-2024-7071
Published: 2024-08-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in Brain Information Technologies Inc. Brain Low-Code allows SQL Injection.This issue affects Brain Low-Code: before 2.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1349
CVE: CVE-2024-6632
Published: 2024-08-27
Description: A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of confidentiality, integrity, and availability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.fortra.com/security/advisories/product-security/fi-2024-010
CVE: CVE-2024-6633
Published: 2024-08-27
Description: The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software.

The HSQLDB is only included to facilitate installation, has been deprecated, and is not intended for production use per vendor guides. However, users who have not configured FileCatalyst Workflow to use an alternative database per recommendations are vulnerable to attack from any source that can reach the HSQLDB.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-798, CWE-798
References: https://www.fortra.com/security/advisories/product-security/fi-2024-011
CVE: CVE-2024-40395
Published: 2024-08-27
Description: An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://pastebin.com/9dc4LYGA
CVE: CVE-2024-41622
Published: 2024-08-27
Description: D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in /HNAP1/ interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-846W; https://github.com/yali-1002/some-poc/blob/main/CVE-2024-41622; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-44340
Published: 2024-08-27
Description: D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and smartqos_normal_devices in SetSmartQoSSettings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-846W; https://github.com/yali-1002/some-poc/blob/main/CVE-2024-44340; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-44341
Published: 2024-08-27
Description: D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-846W; https://github.com/yali-1002/some-poc/blob/main/CVE-2024-44341; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-44342
Published: 2024-08-27
Description: D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the wl(0).(0)_ssid parameter. This vulnerability is exploited via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-846W; https://github.com/yali-1002/some-poc/blob/main/CVE-2024-44342; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-45264
Published: 2024-08-27
Description: A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/TheHermione/CVE-2024-45264; https://skyss.ru
CVE: CVE-2024-8199
Published: 2024-08-27
Description: The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_api_key' function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update API Key options.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/reviews-feed/tags/1.1.2/class/Common/Builder/SBR_Feed_Saver_Manager.php#L699; https://plugins.trac.wordpress.org/changeset/3125315/; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3e89e5-2e7e-497e-b340-b787ebdf3711?source=cve
CVE: CVE-2024-8200
Published: 2024-08-27
Description: The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'update_api_key' function. This makes it possible for unauthenticated attackers to update an API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/reviews-feed/tags/1.1.2/class/Common/Builder/SBR_Feed_Saver_Manager.php#L699; https://plugins.trac.wordpress.org/changeset/3125315/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9e20f7-813c-4691-bce4-d0ff4774ae48?source=cve
CVE: CVE-2024-43788
Published: 2024-08-27
Description: Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61; https://github.com/webpack/webpack/issues/18718#issuecomment[PII_REDACTED]; https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
CVE: CVE-2022-39996
Published: 2024-08-27
Description: Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat; https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat%27s%20Router%20Vulnerability.md
CVE: CVE-2024-36068
Published: 2024-08-27
Description: An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.rubrik.com/advisories/rbk-20240619-v0044; https://www.rubrik.com/products/cloud-data-management
CVE: CVE-2024-42851
Published: 2024-08-27
Description: Buffer Overflow vulnerability in open source exiftags v.1.01 allows a local attacker to execute arbitrary code via the paresetag function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://github.com/T1anyang/fuzzing/tree/main/exiftags
CVE: CVE-2024-43783
Published: 2024-08-27
Description: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances of the Apollo Router running versions >=1.21.0 and < 1.52.1 are impacted by a denial of service vulnerability if _all_ of the following are true: 1. The Apollo Router has been configured to support [External Coprocessing](https://www.apollographql.com/docs/router/customizations/coprocessor). 2. The Apollo Router has been configured to send request bodies to coprocessors. This is a non-default configuration and must be configured intentionally by administrators. Instances of the Apollo Router running versions >=1.7.0 and <1.52.1 are impacted by a denial-of-service vulnerability if all of the following are true: 1. Router has been configured to use a custom-developed Native Rust Plugin. 2. The plugin accesses Request.router_request in the RouterService layer. 3. You are accumulating the body from Request.router_request into memory. If using an impacted configuration, the Router will load entire HTTP request bodies into memory without respect to other HTTP request size-limiting configurations like limits.http_max_request_bytes. This can cause the Router to be out-of-memory (OOM) terminated if a sufficiently large request is sent to the Router. By default, the Router sets limits.http_max_request_bytes to 2 MB. If you have an impacted configuration as defined above, please upgrade to at least Apollo Router 1.52.1. If you cannot upgrade, you can mitigate the denial-of-service opportunity impacting External Coprocessors by setting the coprocessor.router.request.body configuration option to false. Please note that changing this configuration option will change the information sent to any coprocessors you have configured and may impact functionality implemented by those coprocessors. If you have developed a Native Rust Plugin and cannot upgrade, you can update your plugin to either not accumulate the request body or enforce a maximum body size limit. You can also mitigate this issue by limiting HTTP body payload sizes prior to the Router (e.g., in a proxy or web application firewall appliance).
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/apollographql/router/commit/7a9c020608a62dcaa306b72ed0f6980f15923b14; https://github.com/apollographql/router/releases/tag/v1.52.1; https://github.com/apollographql/router/security/advisories/GHSA-x6xq-whh3-gg32
CVE: CVE-2024-7720
Published: 2024-08-27
Description: HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://support.hp.com/us-en/document/ish_1[PII_REDACTED]4432-16/
CVE: CVE-2024-8208
Published: 2024-08-27
Description: A vulnerability has been found in nafisulbari/itsourcecode Insurance Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file editClient.php. The manipulation of the argument AGENT ID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.275917; https://vuldb.com/?id.275917; https://vuldb.com/?submit.393511
CVE: CVE-2024-8209
Published: 2024-08-27
Description: A vulnerability was found in nafisulbari/itsourcecode Insurance Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file addClient.php. The manipulation of the argument CLIENT ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?ctiid.275918; https://vuldb.com/?id.275918; https://vuldb.com/?submit.393512
CVE: CVE-2022-39997
Published: 2024-08-27
Description: A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges
CVSS Score: 8.0 (HIGH)
CWE: CWE-521
References: https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat; https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat%27s%20Router%20Vulnerability.md
CVE: CVE-2024-1544
Published: 2024-08-27
Description: Generating the ECDSA nonce k samples a random number r and then 
truncates this randomness with a modular reduction mod n where n is the 
order of the elliptic curve. Meaning k = r mod n. The division used 
during the reduction estimates a factor q_e by dividing the upper two 
digits (a digit having e.g. a size of 8 byte) of r by the upper digit of 
n and then decrements q_e in a loop until it has the correct size. 
Observing the number of times q_e is decremented through a control-flow 
revealing side-channel reveals a bias in the most significant bits of 
k. Depending on the curve this is either a negligible bias or a 
significant bias large enough to reconstruct k with lattice reduction 
methods. For SECP160R1, e.g., we find a bias of 15 bits.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-203
References: https://github.com/wolfSSL/wolfssl/pull/7020; https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.2-stable
CVE: CVE-2024-45037
Published: 2024-08-27
Description: The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates. We identified an issue in AWS Cloud Development Kit (CDK) which, under certain conditions, can result in granting authenticated Amazon Cognito users broader than intended access. Specifically, if a CDK application uses the "RestApi" construct with "CognitoUserPoolAuthorizer" as the authorizer and uses authorization scopes to limit access. This issue does not affect the availability of the specific API resources. Authenticated Cognito users may gain unintended access to protected API resources or methods, leading to potential data disclosure, and modification issues.  Impacted versions: >=2.142.0;<=2.148.0. A patch is included in CDK versions >=2.148.1. Users are advised to upgrade their AWS CDK version to 2.148.1 or newer and re-deploy their application(s) to address this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-863
References: https://docs.aws.amazon.com/cdk/v2/guide/home.html; https://github.com/aws/aws-cdk/commit/4bee768f07e73ab5fe466f9ad3d1845456a0513b; https://github.com/aws/aws-cdk/releases/tag/v2.148.1
CVE: CVE-2024-5288
Published: 2024-08-27
Description: An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSL_CHECK_SIG_FAULTS is used in signing operations with private ECC keys,

such as in server-side TLS connections, the connection is halted if any fault occurs. The success rate in a certain amount of connection requests can be processed via an advanced technique for ECDSA key recovery.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.2-stable
CVE: CVE-2024-5814
Published: 2024-08-27
Description: A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello.  https://doi.org/10.46586/tches.v2024.i1.457-500
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#add_later
CVE: CVE-2024-5991
Published: 2024-08-27
Description: In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509_check_host() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://https://github.com/wolfSSL/wolfssl/pull/7604; https://github.com/wolfSSL/wolfssl/pull/7604
CVE: CVE-2024-8210
Published: 2024-08-27
Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classified as critical. This affects the function sprintf of the file /cgi-bin/hd_config.cgi. The manipulation of the argument f_mount leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_FMT_R12R5_3rd_DiskMGR.md; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://vuldb.com/?ctiid.275919
CVE: CVE-2024-8211
Published: 2024-08-27
Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been declared as critical. This vulnerability affects the function cgi_FMT_Std2R1_DiskMGR of the file /cgi-bin/hd_config.cgi. The manipulation of the argument f_newly_dev leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_FMT_Std2R1_DiskMGR.md; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://vuldb.com/?ctiid.275920
CVE: CVE-2024-8212
Published: 2024-08-27
Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated as critical. This issue affects the function cgi_FMT_R12R5_2nd_DiskMGR of the file /cgi-bin/hd_config.cgi. The manipulation of the argument f_source_dev leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_FMT_R12R5_2nd_DiskMGR.md; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://vuldb.com/?ctiid.275921
CVE: CVE-2024-8213
Published: 2024-08-27
Description: A vulnerability classified as critical has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. Affected is the function cgi_FMT_R12R5_1st_DiskMGR of the file /cgi-bin/hd_config.cgi. The manipulation of the argument f_source_dev leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_FMT_R12R5_1st_DiskMGR.md; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://vuldb.com/?ctiid.275922
CVE: CVE-2024-8214
Published: 2024-08-27
Description: A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. Affected by this vulnerability is the function cgi_FMT_Std2R5_2nd_DiskMGR of the file /cgi-bin/hd_config.cgi. The manipulation of the argument f_source_dev leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_FMT_Std2R5_2nd_DiskMGR.md; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://vuldb.com/?ctiid.275923