rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-36370 
An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-30T18:37:23.000Z
CVE-2021-36371 
Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate authentication. The attacker must send an SNI specifying an unprotected backend and an HTTP Host header specifying a protected backend. (2.x versions are unaffected. 1.x versions are unaffected with certain configuration settings involving prune_unreachable_routes and a wildcard Host resource.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T20:19:45.000Z
CVE-2021-36372 Original block tokens are persisted and can be retrieved
In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
Problem types: cwe_id: CWE-273
description: CWE-273 Improper Check for Dropped Privileges
Affected products: vendor: Apache Software Foundation
product: Apache Ozone
Credits: lang: en
value: Apache Ozone would like to thank Marton Elek for reporting this issue.
Published: 2021-11-19T09:20:16.000Z
CVE-2021-36373 Apache Ant TAR archive denial of service vulnerability
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Apache Software Foundation
product: Apache Ant
Credits: lang: en
value: This issue is similar to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35517 present in Apache Commons Compress which has been detected by OSS Fuzz.
Published: 2021-07-14T06:20:11.000Z
CVE-2021-36374 Apache Ant ZIP, and ZIP based, archive denial of service vulerability
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Apache Software Foundation
product: Apache Ant
Credits: lang: en
value: This issue is similar to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36090 present in Apache Commons Compress which has been detected by OSS Fuzz.
Published: 2021-07-14T06:20:12.000Z
CVE-2021-36376 
dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-13T12:27:15.000Z
CVE-2021-36377 
Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-12T12:11:49.000Z
CVE-2021-36380 
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:53:59.000Z
CVE-2021-36381 
In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?logon_error= on the login screen of the Web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-12T15:46:28.000Z
CVE-2021-36382 
Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:H/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:R
version: 3.1
Published: 2021-07-12T13:04:50.000Z
CVE-2021-36383 
Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-12T13:18:48.000Z
CVE-2021-36385 
A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe (aka U+FF07) in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xp_cmdshell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-24T11:26:14.000Z
CVE-2021-36386 
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-29T13:59:24.000Z
CVE-2021-36387 
In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-14T18:01:38.000Z
CVE-2021-36388 
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-14T18:16:25.000Z
CVE-2021-36389 
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-14T18:27:27.000Z
CVE-2021-36392 
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36393 
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36394 
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
Problem types: cwe_id: CWE-384
description: CWE-384
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36395 
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36396 
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
Problem types: cwe_id: CWE-918
description: CWE-918
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36397 
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36398 
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36399 
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36400 
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36401 
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36402 
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36403 
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
Problem types: cwe_id: CWE-912
description: CWE-912
Affected products: vendor: n/a
product: Moodle
Published: 2023-03-06T00:00:00.000Z
CVE-2021-36408 
An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-10T00:00:00.000Z
CVE-2021-36409 
There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-10T00:00:00.000Z
CVE-2021-36410 
A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running program dec265.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-10T00:00:00.000Z
CVE-2021-36411 
An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function derive_boundaryStrength of deblock.cc has occurred. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-10T00:00:00.000Z
CVE-2021-36412 
A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly have unspecified other impact via a crafted file in the MP4Box command,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-10T00:00:00.000Z
CVE-2021-36414 
A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-10T00:00:00.000Z
CVE-2021-36417 
A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, which causes a denial of service or execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T00:00:00.000Z
CVE-2021-36424 
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36425 
Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36426 
File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36431 
SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check() function in jocms/apps/mask/inc/mask.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36432 
SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_mask() function in jocms/apps/mask/mask.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36433 
SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_delete_mask function in jocms/apps/mask/mask.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36434 
SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check function in jocms/apps/mask/inc/getmask.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36436 
An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-20T00:00:00.000Z
CVE-2021-36438 
SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-27T00:00:00.000Z
CVE-2021-36440 
Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-08T20:18:25.000Z
CVE-2021-36443 
Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36444 
Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36450 
Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T06:55:56.000Z
CVE-2021-36454 
Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons.php, 6) feeds\feeds.php, 7) functions\functions.php, 8) items\items.php, 9) menus\menus.php, 10) orders\orders.php, 11) payment_methods\payment_methods.php, 12) products\products.php, 13) profiles\profiles.php, 14) shipping_methods\shipping_methods.php, 15) templates\templates.php, 16) users\users.php, 17) webdictionary\webdictionary.php, 18) websites\websites.php, and 19) webusers\webusers.php because the initial_url function is built in these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-06T15:19:01.000Z
CVE-2021-36455 
SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-06T15:25:39.000Z
CVE-2021-36460 
VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-25T12:03:38.000Z
CVE-2021-36461 
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:34:48.000Z
CVE-2021-36471 
Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /admin/index3.html URIs. Note: AdminLTE developers dispute that this a weakness with AdminLTE and is instead a misconfiguration error on various websites by the website developers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-07T00:00:00.000Z
CVE-2021-36483 
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T10:04:29.000Z
CVE-2021-36484 
SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36489 
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36493 
Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36503 
SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36512 
An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an uninitialized value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-19T11:33:42.000Z
CVE-2021-36513 
An issue was discovered in function sofia_handle_sip_i_notify in sofia.c in SignalWire freeswitch before 1.10.6, may allow attackers to view sensitive information due to an uninitialized value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T16:07:09.000Z
CVE-2021-36520 
A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2021-36530 
ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIB_NO_FILE mode, GetByteStr() copy memory buffer without checking the boundary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-27T15:25:19.000Z
CVE-2021-36531 
ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70 in NGIFLIB_NO_FILE mode, GetByte() reads memory buffer without checking the boundary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-27T15:24:14.000Z
CVE-2021-36532 
Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36535 
Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36538 
Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-36539 
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2021-36542 
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T18:09:48.000Z
CVE-2021-36543 
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T18:13:37.000Z
CVE-2021-36544 
Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z