CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2023-1773"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-31T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224674 is the identifier assigned to this vulnerability.",
  "id": "GHSA-jjgj-498m-3v78",
  "modified": "2023-04-06T18:30:16Z",
  "published": "2023-03-31T12:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1773"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/galaxies2580/cve/blob/master/xinhuv2.3.2.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.224674"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.224674"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-23314"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-26T19:15:38Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.",
  "id": "GHSA-jjgw-82ph-6fgv",
  "modified": "2025-08-26T21:31:07Z",
  "published": "2025-08-26T21:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23314"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5689"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23314"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0325"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-01T22:15:55Z",
    "severity": "LOW"
  },
  "details": "In Helix Sync versions prior to 2024.1, a local command injection was identified.  Reported by Bryan Riggins. \u00a0\n",
  "id": "GHSA-jjhm-fvgh-hv85",
  "modified": "2024-02-09T21:30:57Z",
  "published": "2024-02-02T00:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0325"
    },
    {
      "type": "WEB",
      "url": "https://perforce.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-43875"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-15T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Office Graphics Remote Code Execution Vulnerability",
  "id": "GHSA-jjj7-vm6f-q7cx",
  "modified": "2022-07-13T00:01:49Z",
  "published": "2021-12-16T00:01:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43875"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43875"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2013-5036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-05-27T14:55:00Z",
    "severity": "HIGH"
  },
  "details": "The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.",
  "id": "GHSA-jjmf-p64f-6wmv",
  "modified": "2025-04-12T12:34:13Z",
  "published": "2022-05-17T01:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5036"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SquareSquash/web/commit/6d667c19e96e4f23dccbfbe24afeebd18e98e1c5"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86335"
    },
    {
      "type": "WEB",
      "url": "http://ceriksen.com/2013/08/06/squash-remote-code-execution-vulnerability-advisory"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/95992"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/27530"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2009-1230"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-04-02T15:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change action.",
  "id": "GHSA-jjp4-5j58-3cr7",
  "modified": "2022-05-02T03:22:54Z",
  "published": "2022-05-02T03:22:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1230"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/8324"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.123.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.10.0"
            },
            {
              "fixed": "2.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-25T21:23:15Z",
    "nvd_published_at": "2026-02-25T23:16:20Z",
    "severity": "CRITICAL"
  },
  "details": "## Impact\nAn authenticated user with permission to create or modify workflows could exploit a vulnerability in the JavaScript Task Runner sandbox to execute arbitrary code outside the sandbox boundary.\n\nOn instances using internal Task Runners (default runner mode), this could result in full compromise of the n8n host. On instances using external Task Runners, the attacker might gain access to or impact other task executed on the Task Runner.\n- Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`.\n\n## Patches\nThe issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Use external runner mode (`N8N_RUNNERS_MODE=external`) to limit the blast radius.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.\n\n## Resources\n- [n8n Documentation \u2014 Task Runners](https://docs.n8n.io/hosting/configuration/task-runners/)",
  "id": "GHSA-jjpj-p2wh-qf23",
  "modified": "2026-02-27T21:51:21Z",
  "published": "2026-02-25T21:23:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jjpj-p2wh-qf23"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27495"
    },
    {
      "type": "WEB",
      "url": "https://docs.n8n.io/hosting/configuration/task-runners"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/n8n-io/n8n"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.9.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "n8n has a Sandbox Escape in its JavaScript Task Runner"
}

{
  "affected": [],
  "aliases": [
    "CVE-2006-7105"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-03-03T21:19:00Z",
    "severity": "HIGH"
  },
  "details": "** DISPUTED **  PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.  NOTE: in the original disclosure, filename is used in a function definition, so this report is probably incorrect.",
  "id": "GHSA-jjpx-47jx-v4xx",
  "modified": "2025-01-17T15:32:30Z",
  "published": "2022-05-01T07:44:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-7105"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29603"
    },
    {
      "type": "WEB",
      "url": "http://www.security-express.com/archives/fulldisclosure/2006-10/0292.html"
    },
    {
      "type": "WEB",
      "url": "http://www.security-express.com/archives/fulldisclosure/2006-10/0299.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/20557"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.2.1"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "openc3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "7.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77602"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T18:57:24Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nCOSMOS reads configuration from a user-writable overlay (`targets_modified/`) before the read-only plugin-installed `targets/` tree, and the config subsystem executes code on those files: `ConfigParser` renders every file as ERB by default, a `GENERIC_READ_CONVERSION` / `GENERIC_WRITE_CONVERSION` block is evaluated as code by `GenericConversion` (Ruby and Python), and the Script Runner suite analysis `require`s a procedure file. An authenticated user can write into `targets_modified/` below the admin tier (the storage-upload endpoint exempts that area from the admin gate, and the screen-save endpoint stores its body verbatim there), so the same root cause is reachable through several features, each giving arbitrary code execution on a COSMOS server.\n\nThree vulnerable routes were identified, all reachable by an authenticated non-admin user (in the open-source edition `authorize` ignores the permission string, so any authenticated user qualifies):\n\n1. **Table definitions** (immediate). `tables#generate|report|load` reads a definition from `targets_modified/` and ERB-renders it and evaluates its `GENERIC_*_CONVERSION` block in the `cmd-tlm-api` container.\n2. **Command/telemetry definitions** (persistent). A file written to `targets_modified/\u003cTARGET\u003e/cmd_tlm/` is overlaid by `System.setup_targets` and processed by `PacketConfig` in the decom/multi microservices: ERB-rendered in the Ruby implementation, and GENERIC-evaluated in both the Ruby and Python implementations (the Python `ConfigParser` does not run ERB). It executes on the next microservice (re)start.\n3. **Script Runner suites** (immediate). A procedure written to `targets_modified/\u003cTARGET\u003e/procedures/` is `require`d by the suite analysis, reachable at the read-only `script_view` tier through `scripts#body` and `running_script#show` (the analysis subprocess is spawned when `OPENC3_SERVICE_PASSWORD` is configured, which it is in the shipped `.env`).\n\n### Details\n\nRoot cause. `TargetFile.body` (Ruby `openc3/lib/openc3/utilities/target_file.rb`, Python `openc3/python/openc3/utilities/target_file.py`) reads `{scope}/targets_modified/{name}` before `{scope}/targets/{name}`. The storage-upload endpoint `storage_controller.rb get_upload_presigned_request` is gated at `system_set` and exempts `targets_modified/` and `tmp/` from its `admin` check (so a write there is not admin-gated); for a target path it additionally calls `authorize_bucket_path`, which in the permission-enforcing edition requires `tlm` on the target, while in the open-source edition `authorize` ignores the permission string entirely. `screens_controller.rb create` (`system_set`) stores its request body verbatim under `targets_modified/\u003ctarget\u003e/screens/`. So a non-admin can place files in the overlay. The config subsystem then executes them.\n\nSink 1, ERB. `ConfigParser#parse_file` renders the file as ERB before parsing (`run_erb` defaults to true):\n```ruby\n# openc3/lib/openc3/config/config_parser.rb:402\noutput = ERB.new(File.read(filename)...comment_erb(), trim_mode: \"-\").result(...)\n```\nReached for table definitions via `tables_controller.rb` -\u003e `Table.get_definitions` -\u003e `TableConfig.process_file` -\u003e `parse_file`, and for cmd/tlm definitions via `System.setup_targets` (`system.rb`, whose overlay loop copies `targets_modified/\u003cT\u003e/cmd_tlm/*` over the read-only files) -\u003e `PacketConfig#process_file` -\u003e `parse_file`.\n\nSink 2, GENERIC conversion. `PacketConfig`/`TableConfig` build a `GenericConversion` from a `GENERIC_READ_CONVERSION_START .. END` / `GENERIC_WRITE_CONVERSION_START .. END` block, and `GenericConversion#call` evaluates it (independent of ERB):\n```ruby\n# openc3/lib/openc3/conversions/generic_conversion.rb (call)\neval(@code_to_eval)\n# Python openc3/python/openc3/conversions/generic_conversion.py (call): compile()/exec()/eval()\n```\nThe read conversion fires on `tables#report`/`load` and during telemetry decom; the write conversion fires on `tables#generate` and on `restore_defaults`.\n\nSink 3, suite require. The Script Runner suite analysis executes the file:\n```ruby\n# openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb:24\nrequire ARGV[1]      # runs all top-level code of the supplied file\n```\nreached from `Script.process_suite`, invoked by `scripts#body` and `running_script#show` (both `script_view`) and `scripts#create` (`script_edit`) when the file matches the suite pattern.\n\nPermission tiers. Writing the payload needs `system_set` (screen save, storage upload) or `script_edit` (script create); triggering needs `system` (tables) or `script_view` (suite). These are below the tiers where COSMOS gates code execution elsewhere (plugin install requires `admin`, running a script requires `script_run`).\n\n### PoC\n\nTable definition path, against a standard stack. Benign payload writes `id` to a marker file. This PoC uses the open-source password login; in the permission-enforcing edition substitute a bearer token for a user holding the permissions noted above.\n```bash\nBASE=http://localhost:2900/openc3-api      # adjust to your deployment\nTOKEN=$(curl -s -X POST \"$BASE/auth/verify\" -H \u0027Content-Type: application/json\u0027 -d \u0027{\"password\":\"\u003cyour password\u003e\"}\u0027)\n\n# 1) Write the payload into targets_modified/ via the screen save endpoint.\ncurl -s -X POST \"$BASE/screen\" -H \"Authorization: $TOKEN\" \\\n  --data-urlencode \u0027scope=DEFAULT\u0027 --data-urlencode \u0027target=INST\u0027 --data-urlencode \u0027screen=poc\u0027 \\\n  --data-urlencode $\u0027text=SCREEN AUTO AUTO 1.0\\n\u003c%= File.write(\"/tmp/erb_rce_poc\", `id`) %\u003e\\nLABEL poc\u0027\n\n# 2) Trigger by pointing a table action at that file.\ncurl -s -X POST \"$BASE/tables/generate\" -H \"Authorization: $TOKEN\" \\\n  --data-urlencode \u0027scope=DEFAULT\u0027 --data-urlencode \u0027definition=INST/screens/poc.txt\u0027\n```\nThen in the cmd-tlm-api container: `cat /tmp/erb_rce_poc` shows `uid=1001(openc3) ...`. The `tables/generate` request returns HTTP 500 (the screen lines are not valid table keywords); the marker shows the code already ran.\n\nThe same outcome without ERB, using the GENERIC sink, on the same `tables/generate` trigger:\n```\nTABLE \"data\" BIG_ENDIAN KEY_VALUE \"poc\"\n  APPEND_PARAMETER \"item1\" 8 UINT 0 255 0 \"Item\"\n    GENERIC_WRITE_CONVERSION_START\n      `id \u003e /tmp/erb_rce_poc`\n      0\n    GENERIC_WRITE_CONVERSION_END\n```\n\ncmd/tlm path: upload a telemetry definition containing the same ERB or GENERIC block to `targets_modified/\u003cTARGET\u003e/cmd_tlm/\u003cfile\u003e.txt` via the storage-upload presigned request (`system_set`), then the code runs in that target\u0027s decom microservice on its next restart. Suite path: write a suite-shaped procedure to `targets_modified/\u003cTARGET\u003e/procedures/\u003cx\u003e.rb` and call `scripts#body` on it at `script_view`.\n\nThe ERB table chain was confirmed end to end over HTTP against a booted Rails and puma instance.\n\n### Impact\n\nArbitrary code execution as the `openc3` user in the `cmd-tlm-api` container and the per-target decom microservices and the script-runner. Those processes hold the Redis and bucket credentials and sit on the internal service network, so the executed code acts with that authority over configuration, telemetry, and command data across scopes. The API is served through Traefik, which the shipped compose binds to `127.0.0.1:2900`, so a default single-host install is reachable only from the host; a multi-user deployment exposes the web port, and the `AV:N` rating reflects that standard remote-operator exposure.\n\nAll paths require valid authentication, and the triggering permissions (`system`/`system_set`/`script_view`) are below the `admin`/`script_run`/plugin-install tiers where COSMOS gates code execution. In the open-source edition `authorize` checks only token validity and does not enforce the permission string, so any authenticated user can perform these requests.\n\n### Suggested fix\n\nThe fix is to treat the user-writable overlay as data, never code, and to gate the writers, applied uniformly:\n- Load table and cmd/tlm definitions for code-execution paths from the read-only `targets/` tree only, or parse the `targets_modified` overlay with ERB disabled (`run_erb=false`); dynamically-created packet definitions are structural and never need ERB, so this does not regress that feature.\n- Allow only admin and the server-side dynamic-packet mechanism to write a `cmd_tlm` overlay; reject non-canonical object keys so a positional path check cannot be bypassed by a key the object store normalizes differently.\n- Run the Script Runner suite analysis (which executes the file) only at the `script_run` tier, at every entry point.\n- Mirror the definition-read change in the Python implementation.",
  "id": "GHSA-jjq7-m736-w977",
  "modified": "2026-09-23T18:57:24Z",
  "published": "2026-09-23T18:57:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-jjq7-m736-w977"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/pull/3488"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/commit/71943352a28128ef3e7e894319d97a656b5cd4f2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenC3/cosmos/commit/7a1538a4626f82c0d1540fcaa27ffdcbbd71ff81"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenC3/cosmos"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-6038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-11-20T11:46:00Z",
    "severity": "MODERATE"
  },
  "details": "PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.",
  "id": "GHSA-jjr7-489f-2ccr",
  "modified": "2022-05-01T18:39:08Z",
  "published": "2022-05-01T18:39:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-6038"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38555"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/4636"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/26499"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}