deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-34236
Published: 2023-07-14
Description: Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular, functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec` object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`. An unauthorized remote attacker could exploit this vulnerability by accessing these prints of sensitive information, which may contain configurations or tokens that could be used to gain unauthorized control or access to resources managed by the Terraform controller. A successful exploit could allow the attacker to utilize this sensitive data, potentially leading to unauthorized access or control of the system. This vulnerability has been addressed in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users are urged to upgrade to one of these versions to mitigate the vulnerability. As a temporary measure until the patch can be applied, users can add the environment variable `DISABLE_TF_LOGS` to the tf-runners via the runner pod template of the Terraform Custom Resource. This will prevent the logging of sensitive information and mitigate the risk of this vulnerability.
CVSS Score: 8.5 (HIGH)
CWE: CWE-200
References: https://github.com/weaveworks/tf-controller/commit/28282bc644054e157c3b9a3d38f1f9551ce09074; https://github.com/weaveworks/tf-controller/commit/6323b355bd7f5d2ce85d0244fe0883af3881df4e; https://github.com/weaveworks/tf-controller/commit/9708fda28ccd0466cb0a8fd409854ab4d92f7dca
CVE: CVE-2023-36466
Published: 2023-07-14
Description: Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.

CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-287
References: https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932; https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932
CVE: CVE-2023-36818
Published: 2023-07-14
Description: Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit `52b003d915`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/discourse/discourse/commit/52b003d915761f1581ae2d105f3cbe76df7bf1ff; https://github.com/discourse/discourse/security/advisories/GHSA-gxqx-3q2p-37gm; https://github.com/discourse/discourse/commit/52b003d915761f1581ae2d105f3cbe76df7bf1ff
CVE: CVE-2023-37268
Published: 2023-07-14
Description: Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e; https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4; https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e
CVE: CVE-2023-38336
Published: 2023-07-14
Description: netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039689; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039689
CVE: CVE-2023-38337
Published: 2023-07-14
Description: rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/rswag/rswag/compare/2.9.0...2.10.1; https://github.com/rswag/rswag/issues/653; https://github.com/rswag/rswag/compare/2.9.0...2.10.1
CVE: CVE-2023-37793
Published: 2023-07-14
Description: WAYOS FBM-291W 19.09.11V was discovered to contain a buffer overflow via the component /upgrade_filter.asp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/PwnYouLin/IOT_vul/blob/main/wayos/2/readme.md; https://github.com/PwnYouLin/IOT_vul/blob/main/wayos/2/readme.md
CVE: CVE-2023-37794
Published: 2023-07-14
Description: WAYOS FBM-291W 19.09.11V was discovered to contain a command injection vulnerability via the component /upgrade_filter.asp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/PwnYouLin/IOT_vul/tree/main/wayos/1; https://github.com/PwnYouLin/IOT_vul/tree/main/wayos/1
CVE: CVE-2023-35802
Published: 2023-07-15
Description: IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploited to obtain elevated privileges to conduct remote code execution. Access to the internal management interface/subnet is required to conduct the exploit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://extremeportal.force.com/ExtrArticleDetail?an=000112741; https://extremeportal.force.com/ExtrArticleDetail?an=000112741
CVE: CVE-2023-38349
Published: 2023-07-15
Description: PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/pnp4nagios/pnp4nagios/pull/17; https://github.com/pnp4nagios/pnp4nagios/pull/17
CVE: CVE-2023-38350
Published: 2023-07-15
Description: PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pnp4nagios/pnp4nagios/pull/16; https://github.com/pnp4nagios/pnp4nagios/pull/16
CVE: CVE-2023-3678
Published: 2023-07-15
Description: A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_inquiry of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-234223.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234223; https://vuldb.com/?id.234223; https://vuldb.com/?ctiid.234223
CVE: CVE-2023-3679
Published: 2023-07-15
Description: A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=save_inquiry of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-234224.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234224; https://vuldb.com/?id.234224; https://vuldb.com/?ctiid.234224
CVE: CVE-2023-3680
Published: 2023-07-15
Description: A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part of the file /classes/Master.php?f=save_item of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-234225 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234225; https://vuldb.com/?id.234225; https://vuldb.com/?ctiid.234225
CVE: CVE-2023-3681
Published: 2023-07-15
Description: A vulnerability classified as problematic was found in Campcodes Retro Cellphone Online Store 1.0. This vulnerability affects unknown code of the file /admin/modal_add_product.php. The manipulation of the argument description leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-234226 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Retro%20Cellphone%20Online%20Store%20-%20vlun%208.pdf; https://vuldb.com/?ctiid.234226; https://vuldb.com/?id.234226
CVE: CVE-2023-3682
Published: 2023-07-15
Description: A vulnerability, which was classified as critical, was found in Nesote Inout Blockchain EasyPayments 1.0. Affected is an unknown function of the file /index.php/payment/getcoinaddress of the component POST Parameter Handler. The manipulation of the argument coinid leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234228. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234228; https://vuldb.com/?id.234228; https://vuldb.com/?ctiid.234228
CVE: CVE-2023-2268
Published: 2023-07-15
Description: Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://fluidattacks.com/advisories/giardino/; https://github.com/makeplane/plane; https://fluidattacks.com/advisories/giardino/
CVE: CVE-2023-2507
Published: 2023-07-15
Description: CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.

This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/maiden/; https://github.com/CleverTap/clevertap-cordova; https://github.com/CleverTap/clevertap-cordova/releases/tag/2.7.0
CVE: CVE-2023-30791
Published: 2023-07-15
Description: Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.

CVSS Score: 7.1 (HIGH)
CWE: CWE-434, CWE-434
References: https://fluidattacks.com/advisories/indio/; https://github.com/makeplane/plane; https://fluidattacks.com/advisories/indio/
CVE: CVE-2023-36165
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-36166
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-36168
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-36169
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37800
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37801
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37802
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37803
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37804
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37805
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37806
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37807
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37808
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37809
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37810
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37811
Published: 2023-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2021-31294
Published: 2023-07-15
Description: Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617
References: https://github.com/redis/redis/commit/46f4ebbe842620f0976a36741a72482620aa4b48; https://github.com/redis/redis/commit/6cbea7d29b[PII_REDACTED]bc1c351abba1a7ef326f; https://github.com/redis/redis/issues/8712
CVE: CVE-2023-3692
Published: 2023-07-16
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/admidio/admidio/commit/d66585d14b1160712a8a9bfaf9769dd3da0e9a83; https://huntr.dev/bounties/be6616eb-384d-40d6-b1fd-0ec9e4973f12; https://github.com/admidio/admidio/commit/d66585d14b1160712a8a9bfaf9769dd3da0e9a83
CVE: CVE-2023-3683
Published: 2023-07-16
Description: A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /items/search. The manipulation of the argument search_term leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.234229; https://vuldb.com/?id.234229; https://vuldb.com/?ctiid.234229
CVE: CVE-2023-3684
Published: 2023-07-16
Description: A vulnerability was found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /change-language/de_DE of the component Base64 Encoding Handler. The manipulation of the argument redirectTo leads to open redirect. The attack may be launched remotely. VDB-234230 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-601, CWE-601
References: https://vuldb.com/?ctiid.234230; https://vuldb.com/?id.234230; https://vuldb.com/?ctiid.234230
CVE: CVE-2023-3685
Published: 2023-07-16
Description: A vulnerability was found in Nesote Inout Search Engine AI Edition 1.1. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-234231. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.234231; https://vuldb.com/?id.234231; https://vuldb.com/?ctiid.234231
CVE: CVE-2023-3686
Published: 2023-07-16
Description: A vulnerability was found in Bylancer QuickAI OpenAI 3.8.1. It has been declared as critical. This vulnerability affects unknown code of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-234232. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234232; https://vuldb.com/?id.234232; https://vuldb.com/?ctiid.234232
CVE: CVE-2023-3687
Published: 2023-07-16
Description: A vulnerability was found in Bylancer QuickVCard 2.1. It has been rated as critical. This issue affects some unknown processing of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may be initiated remotely. The identifier VDB-234233 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?ctiid.234233; https://vuldb.com/?id.234233; https://vuldb.com/?ctiid.234233
CVE: CVE-2023-3688
Published: 2023-07-16
Description: A vulnerability classified as critical has been found in Bylancer QuickJob 6.1. Affected is an unknown function of the component GET Parameter Handler. The manipulation of the argument keywords/gender leads to sql injection. It is possible to launch the attack remotely. VDB-234234 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234234; https://vuldb.com/?id.234234; https://vuldb.com/?ctiid.234234
CVE: CVE-2023-3689
Published: 2023-07-16
Description: A vulnerability classified as critical was found in Bylancer QuickQR 6.3.7. Affected by this vulnerability is an unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-234235. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234235; https://vuldb.com/?id.234235; https://vuldb.com/?ctiid.234235
CVE: CVE-2023-3690
Published: 2023-07-16
Description: A vulnerability, which was classified as critical, has been found in Bylancer QuickOrder 6.3.7. Affected by this issue is some unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-234236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.234236; https://vuldb.com/?id.234236; https://vuldb.com/?ctiid.234236
CVE: CVE-2023-38378
Published: 2023-07-16
Description: The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://news.ycombinator.com/item?id=36745664; https://tortel.li/post/insecure-scope/; https://news.ycombinator.com/item?id=36745664
CVE: CVE-2023-38379
Published: 2023-07-16
Description: The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length pass0 to the webcontrol changepwd.cgi application, i.e., the entered password only needs to match the first zero characters of the saved password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://news.ycombinator.com/item?id=36745664; https://tortel.li/post/insecure-scope/; https://news.ycombinator.com/item?id=36745664
CVE: CVE-2023-3691
Published: 2023-07-16
Description: A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/layui/layui/issues/I7HDXZ; https://gitee.com/layui/layui/tree/v2.8.0; https://vuldb.com/?ctiid.234237
CVE: CVE-2023-3693
Published: 2023-07-16
Description: A vulnerability classified as critical was found in SourceCodester Life Insurance Management System 1.0. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234244.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/tangyi19/Life-Insurance-Management-System/blob/main/Life%20Insurance%20Management%20System%20login.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.234244; https://vuldb.com/?id.234244
CVE: CVE-2023-30988
Published: 2023-07-16
Description: The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability.  A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system.  IBM X-Force ID:  254016.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254016; https://www.ibm.com/support/pages/node/7012355; https://exchange.xforce.ibmcloud.com/vulnerabilities/254016