rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-25030 
In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage. Popular hashing algorithms based on the Merkle-Damgardconstruction (such as MD5 and SHA-1) alone are insufficient in thwarting password cracking. Attackers can generate and use precomputed hashes for all possible password character combinations (commonly referred to as "rainbow tables") relatively quickly. The use of adaptive hashing algorithms such asscryptorbcryptor Key-Derivation Functions (i.e.PBKDF2) to hash passwords make generation of such rainbow tables computationally infeasible.
Problem types: cwe_id: CWE-522
description: Insufficiently Protected Credentials (CWE-522)
Affected products: vendor: n/a
product: Versa Director, Versa Analytics, Versa VOS
Published: 2021-05-26T18:45:38.000Z
CVE-2019-25031 
Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:18:17.000Z
CVE-2019-25032 
Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:18:00.000Z
CVE-2019-25033 
Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:17:53.000Z
CVE-2019-25034 
Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:17:43.000Z
CVE-2019-25035 
Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:17:34.000Z
CVE-2019-25036 
Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:17:26.000Z
CVE-2019-25037 
Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:17:13.000Z
CVE-2019-25038 
Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:17:03.000Z
CVE-2019-25039 
Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:16:54.000Z
CVE-2019-25040 
Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:16:44.000Z
CVE-2019-25041 
Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:16:35.000Z
CVE-2019-25042 
Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T05:16:24.000Z
CVE-2019-25043 
ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T16:32:34.000Z
CVE-2019-25044 
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-14T22:57:29.000Z
CVE-2019-25045 
An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-07T19:19:06.000Z
CVE-2019-25046 
The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T11:39:28.000Z
CVE-2019-25047 
Greenbone Security Assistant (GSA) before 8.0.2 and Greenbone OS (GOS) before 5.0.10 allow XSS during 404 URL handling in gsad.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-21T14:08:38.000Z
CVE-2019-25048 
LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T02:53:25.000Z
CVE-2019-25049 
LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T02:53:38.000Z
CVE-2019-25050 
netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-20T06:46:38.000Z
CVE-2019-25051 
objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-20T06:46:25.000Z
CVE-2019-25052 
In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T14:59:12.000Z
CVE-2019-25053 
A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2019-25054 
An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:54:36.000Z
CVE-2019-25055 
An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:54:23.000Z
CVE-2019-25056 
In Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing which resources are blocked and which aren't can identify the application version and defeat the User-Agent protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T04:20:10.000Z
CVE-2019-25057 
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T20:10:10.000Z
CVE-2019-25058 
An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devices to be connected in the future.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-24T01:53:33.000Z
CVE-2019-25059 
Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-25T03:29:14.000Z
CVE-2019-25060 WP-GraphQL < 0.3.5 - Improper Access Control
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: WPGraphQL
Credits: lang: en
value: Rohan Pagey
Published: 2022-05-09T16:50:25.000Z
CVE-2019-25061 
The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-18T05:49:20.000Z
CVE-2019-25062 Sricam IP CCTV Camera Device Viewer stack-based overflow
A vulnerability was found in Sricam IP CCTV Camera and classified as critical. This issue affects some unknown processing of the component Device Viewer. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Sricam
product: IP CCTV Camera
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Alessandro Magnosi
Published: 2022-06-04T05:00:16.000Z
CVE-2019-25063 Sricam IP CCTV Camera Device Viewer memory corruption
A vulnerability was found in Sricam IP CCTV Camera. It has been classified as critical. Affected is an unknown function of the component Device Viewer. The manipulation leads to memory corruption. Local access is required to approach this attack.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: Sricam
product: IP CCTV Camera
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-06-04T05:00:17.000Z
CVE-2019-25064 CoreHR Core Portal cross-site request forgery
A vulnerability was found in CoreHR Core Portal up to 27.0.7. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. Upgrading to version 27.0.8 is able to address this issue. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery
Affected products: vendor: CoreHR
product: Core Portal
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Alessandro Magnosi
Published: 2022-06-09T13:10:24.000Z
CVE-2019-25065 OpenNetAdmin os command injection
A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: unspecified
product: OpenNetAdmin
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Matt Pascoe
Published: 2022-06-09T13:10:26.000Z
CVE-2019-25066 ajenti API privileges management
A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: unspecified
product: ajenti
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Jeremy Brown
Published: 2022-06-09T13:10:27.000Z
CVE-2019-25067 Podman/Varlink API Privilege Escalation
A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-143949 was assigned to this vulnerability.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Podman
vendor: n/a
product: Varlink
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Jeremy Brown
lang: en
value: misc (VulDB User)
Published: 2022-06-09T13:10:29.000Z
CVE-2019-25068 Axios Italia Axios RE Connection REDefault.aspx privileges management
A vulnerability classified as critical was found in Axios Italia Axios RE 1.7.0/7.0.0. This vulnerability affects unknown code of the file REDefault.aspx of the component Connection Handler. The manipulation of the argument DBIDX leads to privilege escalation. The attack can be initiated remotely.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Axios Italia
product: Axios RE
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: ErPaciocco
Published: 2022-06-09T13:10:31.000Z
CVE-2019-25069 Axios Italia Axios RE Error Message ASP.NET information disclosure
A vulnerability, which was classified as problematic, has been found in Axios Italia Axios RE 1.7.0/7.0.0. This issue affects some unknown processing of the component Error Message Handler. The manipulation leads to information disclosure (ASP.NET). The attack may be initiated remotely.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Disclosure
Affected products: vendor: Axios Italia
product: Axios RE
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: ErPaciocco
Published: 2022-06-09T13:10:32.000Z
CVE-2019-25070 WolfCMS User Add cross site scripting
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in WolfCMS up to 0.8.3.1. It has been rated as problematic. This issue affects some unknown processing of the file /wolfcms/?/admin/user/add of the component User Add. The manipulation of the argument name leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-135125 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-80
description: CWE-80 Basic Cross Site Scripting
Affected products: vendor: n/a
product: WolfCMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: pramodrana (VulDB User)
Published: 2022-06-09T13:10:34.000Z
CVE-2019-25071 Apple iOS Siri Self privileges management
A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Apple
product: iOS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Marc Ruef
Published: 2022-06-25T06:10:12.000Z
CVE-2019-25072 Uncontrolled resource consumption in github.com/tendermint/tendermint
Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.
Problem types: description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: github.com/tendermint/tendermint
product: github.com/tendermint/tendermint/rpc/lib/client
default_status: unaffected
Credits: lang: en
value: @guagualvcha
Published: 2022-12-27T21:13:24.222Z
CVE-2019-25073 Path traversal in github.com/goadesign/goa
Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.
Problem types: description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory('Path Traversal')
Affected products: vendor: github.com/goadesign/goa
product: github.com/goadesign/goa
default_status: unaffected
vendor: goa.design/goa
product: goa.design/goa
default_status: unaffected
vendor: goa.design/goa/v3
product: goa.design/goa/v3
default_status: unaffected
Credits: lang: en
value: @christi3k
Published: 2022-12-27T21:13:17.493Z
CVE-2019-25075 
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T00:53:58.000Z
CVE-2019-25076 
The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (delays of legitimate traffic) via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache, aka a Tuple Space Explosion (TSE) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-08T22:08:42.000Z
CVE-2019-25078 pacparser pacparser.c pacparser_find_proxy buffer overflow
A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparser_find_proxy of the file src/pacparser.c. The manipulation of the argument url leads to buffer overflow. Attacking locally is a requirement. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is 853e8f45607cb07b877ffd270c63dbcdd5201ad9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215443.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption -> CWE-120 Buffer Overflow
Affected products: vendor: unspecified
product: pacparser
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2022-12-13T00:00:00.000Z