vdanen/rhvex-cve huggingface dataset:
CVE-2020-12965 (Moderate severity, published 2023-12-04)
CVSS score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Description: A flaw was found in AMD CPUs. When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits, potentially resulting in data leakage.
Statement: The SLAM Attack is a new Spectre-based vulnerability that impacts most of the future CPU's for Intel, AMD, and ARM. In the current scenario, this vulnerability does not affect RHEL kernel.
CVE-2020-10958 (Moderate severity, published 2020-05-17)
CVSS score: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-416
Description: In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
CVE-2020-24504 (Moderate severity, published 2021-02-16)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-400
Description: An uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux may allow an authenticated user to potentially cause a denial of service via local access.
CVE-2020-13362 (Low severity, published 2020-05-06)
CVSS score: 3.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
CWE: CWE-125
Description: An out-of bounds read-access flaw was found in the MegaRAID SAS 8708EM2 emulator of the QEMU. This flaw occurs in the' megasas_lookup_frame' routine when the 's->reply_queue_head' is set to a malicious value. A guest user or process may use this flaw to crash the QEMU process on the host resulting in a denial of service.
CVE-2020-29623 (Low severity, published 2021-03-21)
CVSS score: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CWE: CWE-459
Description: A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully delete the browsing history under some circumstances. The highest threat from this vulnerability is to data confidentiality.
CVE-2020-25600 (Moderate severity, published 2020-09-22)
CVSS score: 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CWE: CWE-440
Description: A flaw was found in Xen. Misbehavior during domain initialization, where 32-bit domains (including Domain 0) servicing other domains, may observe event channel allocations to succeed when they should fail. Subsequent use of such event channels leads to the corruption of other parts of the shared information structure. This flaw allows an unprivileged guest to crash another domain, particularly Domain 0, leading to a denial of service (DoS) for the entire system. The highest threat from this vulnerability is to system availability.
Statement: All Xen versions from 4.4 onwards are vulnerable. Red Hat Enterprise Linux 5 is not affected by this flaw, as it shipped with an older version of Xen.
Mitigation: There is no known workaround for x86 32-bit Domain 0. The issue can be avoided by reducing the number of event channels available to the guest to no more than 1023.  For example, setting `max_event_channels=1023` in the xl domain configuration, or deleting any existing setting (since 1023 is the default for xl/libxl).
CVE-2020-36186 (Important severity, published 2020-12-22)
CVSS score: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-502
Description: A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: The following Red Hat products do ship the vulnerable component, but do not enable the unsafe conditions needed to exploit, lowering their vulnerability impact:
* JBoss Data Grid 7
* Business Process Management Suite 6
* Business Rules Management Suite 6
* JBoss Data Virtualization 6
* Red Hat Fuse Service Works 6
* Red Hat OpenStack Platform
* Red Hat OpenShift containers: ose-metering-hadoop, ose-metering-hive, ose-logging-elasticsearch5, ose-logging-elasticsearch6  
These products may update the jackson-databind dependency in a future release.

In Red Hat Openshift 4 there are no plans to maintain the ose-logging-elasticsearch5 container, therefore it has been marked wontfix at this time and maybe fixed in a future update. 

The following Red Hat products ship OpenDaylight, which contain the vulnerable jackson-databind, but do not expose jackson-databind in a way that would make it exploitable:
* Red Hat OpenStack Platform 13
As such, Red Hat will not be providing a fix for OpenDaylight at this time.

The following Red Hat products are not affected by this flaw because they use a more recent version of jackson-databind that does not contain the vulnerable code:
* CodeReady Studio 12.16.0
* Red Hat Enterprise Linux 8
* Red Hat Enterprise Virtualization
* Red Hat Satellite 6
* Red Hat OpenShift container: ose-metering-presto
Mitigation: The following conditions are needed for an exploit, we recommend avoiding all if possible:
* Deserialization from sources you do not control
* `enableDefaultTyping()`
* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`
* avoid: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource
in the classpath
CVE-2020-27847 (Critical severity, published 2020-12-14)
CVSS score: 3.9 (CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L)
CWE: CWE-290
Description: A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Statement: Red Hat Advanced Cluster Management for Kubernetes 2.1 packages the dexidp/dex library in observatorium-container for use in testing.  In production, this library and its functionality are not used, and can not be reached by an attacker.  Thus, the severity of this vulnerability has been downgraded for this product.  A future update will remove this dependency.
CVE-2020-14624 (Moderate severity, published 2020-07-13)
CVSS score: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2020-6498 (Moderate severity, published 2020-06-02)
CVSS score: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Description: Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2020-6532 (Important severity, published 2020-07-26)
CVSS score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CWE: CWE-416
Description: Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-23804 (Moderate severity, published 2020-06-28)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-400
Description: A vulnerability was found in Poppler, where a uncontrolled recursion in pdfinfo, and pdftops allows remote attackers to cause a denial of service via crafted input.
CVE-2020-10688 (Moderate severity, published 2020-02-17)
CVSS score: 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
CWE: CWE-79
Description: A cross-site scripting (XSS) flaw was found in RESTEasy, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
CVE-2020-10722 (Moderate severity, published 2020-05-17)
CVSS score: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-190
Description: A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption.
Statement: This issue did not affect the versions of Ceph as shipped with Red Hat Ceph Storage 3 and 4, as they did not include support for DPDK.
CVE-2020-6477 (Moderate severity, published 2020-05-18)
CVSS score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Description: Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to perform privilege escalation via a crafted file.
CVE-2020-11099 (Moderate severity, published 2020-06-21)
CVSS score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
CWE: CWE-125
Description: In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.
CVE-2020-14331 (Moderate severity, published 2020-07-27)
CVSS score: 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-787
Description: A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: This flaw is rated as a having Moderate impact, because only local user with access to VGA console can trigger it (for example if booting with param "nomodeset").
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2020-24553 (Moderate severity, published 2020-07-31)
CVSS score: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CWE: CWE-79
Description: A flaw was found in the Go standard library packages before upstream versions 1.15 and 1.14.8. Both the net/http/cgi and net/http/fcgi packages use a default Content-Type response header value of "text/html", rather than "text/plain". This flaw allows an attacker to exploit this issue in applications using these packages by uploading crafted files, allowing a Cross-site Scripting attack (XSS). The highest threat from this vulnerability is to confidentiality and integrity.
Statement: Multiple components in the Red Hat OpenShift Container Platform are built with Go and use net/http, however, none include the specific vulnerable packages net/http/cgi and net/http/fcgi. Red Hat OpenShift Container Platform is not affected by this flaw.
CVE-2020-29361 (Moderate severity, published 2020-12-11)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-190
Description: An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.
Statement: The p11-kit library is primarily intended to be used locally, in which case the attacker needs to have sufficient permission to access the p11-kit communication. Although there may be use cases of p11-kit being used with a remote entity, all parties must be considered trusted.
As a result, Red Hat considers this vulnerability with a Medium severity.
CVE-2020-35342 (Moderate severity, published 2019-12-26)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Description: GNU Binutils has an uninitialized-heap vulnerability in function tic4x_print_cond in opcodes/tic4x-dis.c file which could allow attackers to make an information leak.
CVE-2020-16588 (Low severity, published 2020-12-09)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CWE: CWE-476
Description: A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.
Statement: This flaw does not affect Red Hat Enterprise Linux 8 because the vulnerable exrmakepreview program is not shipped.
CVE-2020-9805 (Moderate severity, published 2020-07-09)
CVSS score: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
CWE: CWE-79
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.
CVE-2020-25712 (Important severity, published 2020-11-30)
CVSS score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-122
Description: A flaw was found in xorg-x11-server. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: The Xorg server in Red Hat Enterprise Linux 8 does not run with root privileges, thus this flaw has been rated as having a moderate impact on that platform.
CVE-2020-17376 (Important severity, published 2020-08-25)
CVSS score: 8.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)
CWE: CWE-200
Description: An information disclosure flaw was found in the live migration feature of OpenStack Nova. A user may gain access to destination host devices with the same path as those on the source host. This flaw allows an attacker to perform a soft reboot of an instance that has previously undergone live migration. The greatest impact of this vulnerability is to the confidentiality of many possible device types, but those at special risk are block storage devices, potentially revealing data of other users.
Statement: Red Hat OpenStack Platform 10 was initially marked as affected, however it has since been discovered that the flaw is actually not present in this version. For this reason, the update in RHSA-2020:3711 can be either applied or ignored for RHOSP 10.
Mitigation: Public clouds using non-default configurations (allowing untrusted users to initiate live migrations) face significant additional risk. If it is not possible to immediately apply patches, a temporary policy change is recommended: disable soft reboots by setting wait_soft_reboot_seconds to zero. This effectively forces any soft reboots to instead be overridden as a hard reboot. Find more information in Nova's documentation https://docs.openstack.org/nova/ussuri/configuration/config.html

Deployments which use unique device paths for each cinder volume face an extremely low risk of being affected by this flaw.
CVE-2020-14809 (Moderate severity, published 2020-10-19)
CVSS score: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2020-26978 (Moderate severity, published 2020-12-14)
CVSS score: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CWE: CWE-200
Description: The Mozilla Foundation Security Advisory describes this flaw as:

Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine.
CVE-2020-25657 (Moderate severity, published 2020-11-12)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CWE: CWE-203
Description: A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality.
CVE-2020-11758 (Moderate severity, published 2020-02-07)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CWE: CWE-125
Description: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h.
Statement: The versions of OpenEXR shipped with Red Hat Enterprise Linux 7 and prior are not affected by this vulnerability.
CVE-2020-13765 (Moderate severity, published 2020-05-11)
CVSS score: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CWE: CWE-787
Description: An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the rom_copy() routine while loading the contents of a 32-bit -kernel image into memory. Running an untrusted -kernel image may load contents at arbitrary memory locations, potentially leading to code execution with the privileges of the QEMU process.
Statement: In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP qemu-kvm-rhev package.
CVE-2020-25084 (Low severity, published 2020-06-23)
CVSS score: 3.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
CWE: CWE-416
Description: A use-after-free flaw was found in the USB(xHCI/eHCI) controller emulators of QEMU. This flaw occurs while setting up the USB packet as a usb_packet_map() routine and returns an error that was not checked. This flaw allows a guest user or process to crash the QEMU process, resulting in a denial of service.
Statement: In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP qemu-kvm-rhev package.
CVE-2020-2875 (Low severity, published 2020-04-14)
CVSS score: 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Description: A flaw was found in the mysql-connector-java package. A complicated attack against the mysql Connector/J allows attackers on the local network to interfere with a user's connection and insert unauthorized SQL commands in MySQL Connectors and other products.
Statement: Red Hat Enterprise Linux customers are advised to replace the mysql-connector-java package with the mariadb-java-client, available in Red Hat Software Collections.  It can be installed this way:
~~~
yum-config-manager --enable rhel-server-rhscl-7-rpms
yum install rh-mariadb103-mariadb-java-client
~~~
CVE-2020-6565 (Moderate severity, published 2020-08-24)
CVSS score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Description: Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVE-2020-15961 (Important severity, published 2020-09-20)
CVSS score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Description: Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVE-2020-14389 (Moderate severity, published 2020-11-03)
CVSS score: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
CWE: CWE-916
Description: A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission.
CVE-2020-26217 (Important severity, published 2020-11-16)
CVSS score: 9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
CWE: CWE-502
Description: A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://www.jenkins.io/security/advisory/2017-02-01/  (see SECURITY-383 / CVE-2017-2608)
Mitigation: Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address.

Allow list approach
```java
XStream xstream = new XStream();
XStream.setupDefaultSecurity(xstream);
xstream.allowTypesByWildcard(new String[] {"com.misc.classname"})
```

Deny list for XStream 1.4.13
```java
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });
```

Deny list for XStream 1.4.7 -> 1.4.12
```java
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });
```

Deny list for versions prior to XStream 1.4.7
```java
xstream.registerConverter(new Converter() {
  public boolean canConvert(Class type) {
    return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type));
  }

  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }

  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }
}, XStream.PRIORITY_LOW);
```
CVE-2020-14366 (Moderate severity, published 2020-11-03)
CVSS score: 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
CWE: CWE-22
Description: A flaw was found in keycloak.  A path traversal, using URL-encoded path segments in a request, is possible due to transformation of the URL path to a file path at the resource endpoint. The highest threat from this vulnerability is to data confidentiality.