Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
HSA-5vvg-pvhp-hv2m - https://github.com/snowflakedb/snowflake-connector-python/commit/dbc9284a3c0382c131b971b35e8d6ab93c46f37a
CVE ID: CVE-2024-49751 State: PUBLISHED Published: 2024-10-23T15:45:12.348Z Last Updated: 2024-10-23T16:27:13.106Z Vendors: frappe Products: press Problem Types: CWE-79 Description: Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, a user could inject HTML through SaaS signup inputs. The user who injected the unsafe HTML code would only affect themselves and would not affect other users. Commit 5d118a902872d7941f099ad1fb918e2421e79ccd patches this bug. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/press/se
cd patches this bug. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/press/security/advisories/GHSA-rf69-h96f-rf2j - https://github.com/frappe/press/commit/5d118a902872d7941f099ad1fb918e2421e79ccd
CVE ID: CVE-2024-49753 State: PUBLISHED Published: 2024-10-25T14:11:44.092Z Last Updated: 2024-10-25T16:17:38.587Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-20 Description: Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send
nt such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-6cf5-w9h3-4rqv - https://github.com/zitadel/zitadel/releases/tag/v2.58.7 - https://github.com/zitadel/zitadel/releases/ta
cf5-w9h3-4rqv - https://github.com/zitadel/zitadel/releases/tag/v2.58.7 - https://github.com/zitadel/zitadel/releases/tag/v2.59.5 - https://github.com/zitadel/zitadel/releases/tag/v2.60.4 - https://github.com/zitadel/zitadel/releases/tag/v2.61.4 - https://github.com/zitadel/zitadel/releases/tag/v2.62.8 - https://github.com/zitadel/zitadel/releases/tag/v2.63.6 - https://github.com/zitadel/zitadel/releases/tag/v2.64.1
CVE ID: CVE-2024-49754 State: PUBLISHED Published: 2024-11-15T15:11:50.114Z Last Updated: 2024-11-15T18:54:23.916Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This
cious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-gfwr-xqmj-j27v - https://github.com/librenms/librenms/commit/25988a937cbaebd2ba4c0517510206c404dfb359
CVE ID: CVE-2024-49755 State: PUBLISHED Published: 2024-10-28T19:44:15.536Z Last Updated: 2024-10-29T17:54:35.440Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: DuendeSoftware Products: IdentityServer Problem Types: CWE-287 Description: Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens. Note that this only impacts custom endpoints within an IdentityServer implem
g the private key for signing proof tokens. Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. This vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-v9xq-2mvm-x8xc - https://github.com/DuendeSoftware/IdentityServer/commit/f28cac921c1f545afe65af71a9327224755b6dac
CVE ID: CVE-2024-49756 State: PUBLISHED Published: 2024-10-23T17:04:50.037Z Last Updated: 2024-10-24T13:59:48.830Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ash-project Products: ash_postgres Problem Types: CWE-552 Description: AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions (no changing fields), and would allow their hooks (side effects) to be performed when they should not have been. Note that this does not allow reading new data that th
ks (side effects) to be performed when they should not have been. Note that this does not allow reading new data that the user should not have had access to, only triggering a side effect a user should not have been able to trigger. To be vulnerable, an affected user must have an update action that is on a resource with no attributes containing an "update default" (updated_at timestamp, for example); can be performed atomically; does not have `require_atomic? false`; has at least one authorizer (typically `Ash.Policy.Authorizer`); and has at least one `change` (on the resource's `changes` block or in the action itself). This is where the side-effects would be performed when they should not h
rce's `changes` block or in the action itself). This is where the side-effects would be performed when they should not have been. This problem has been patched in `2.4.10` of `ash_postgres`. Several workarounds are available. Potentially affected users may determine that none of their actions are vulnerable using a script the maintainers provide in the GitHub Security Advisory, add `require_atomic? false` to any potentially affected update action, replace any usage of `Ash.update` with `Ash.bulk_update` for an affected action, and/or add an update timestamp to their action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ash-project/ash_postgres/security/a
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ash-project/ash_postgres/security/advisories/GHSA-hf59-7rwq-785m - https://github.com/ash-project/ash_postgres/commit/1228fcd851f29a68609e236f7d6a2622a4b5c4ba - https://elixirforum.com/t/empty-update-action-with-policies/66954 - https://gist.github.com/zachdaniel/e49166b765978c48dfaf998d06df436e
CVE ID: CVE-2024-49757 State: PUBLISHED Published: 2024-10-25T14:22:49.500Z Last Updated: 2024-10-25T16:14:16.296Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-287 Description: The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and regist
in page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-3rmw-76m6-4gjc - https://github.com/zitadel/zitadel/releases/tag/v2.58.7 - https://github.com/zitadel/zitadel/releases/tag/v2.59.5 - https://github.com/zitadel/zitadel/releases/tag/v2.60.4 - https://github.com/zitadel/zitadel/releases/tag/v2.61.4 - https://github.com/zitadel/zitadel/releases/tag/v2.62.7 - https:/
ps://github.com/zitadel/zitadel/releases/tag/v2.61.4 - https://github.com/zitadel/zitadel/releases/tag/v2.62.7 - https://github.com/zitadel/zitadel/releases/tag/v2.63.5 - https://github.com/zitadel/zitadel/releases/tag/v2.64.0
CVE ID: CVE-2024-49758 State: PUBLISHED Published: 2024-11-15T15:17:52.085Z Last Updated: 2024-11-15T18:52:50.332Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device's Notes, its will be trigger. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advis
.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-c86q-rj37-8f85 - https://github.com/librenms/librenms/commit/24b142d753898e273ec20b542a27dd6eb530c7d8
CVE ID: CVE-2024-49759 State: PUBLISHED Published: 2024-11-15T15:26:04.124Z Last Updated: 2024-11-15T16:54:09.169Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "bill_name" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill Access" dropdown in the user's "Manage Access" page, potentially compromisin
n of malicious code when visiting the "Bill Access" dropdown in the user's "Manage Access" page, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-888j-pjqh-fx58 - https://github.com/librenms/librenms/commit/237f4d2e818170171dfad6efad36a275cd2ba8d0
CVE ID: CVE-2024-49760 State: PUBLISHED Published: 2024-10-24T21:35:28.932Z Last Updated: 2024-10-25T17:22:03.158Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: OpenRefine Products: OpenRefine Problem Types: CWE-22 Description: OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions prior to 3.8.3, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system
in the expected directory, which means that this command could be exploited to read other JSON files on the file system. Version 3.8.3 addresses this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qfwq-6jh6-8xx4 - https://github.com/OpenRefine/OpenRefine/commit/24d084052dc55426fe460f2a17524fd18d28b20c
CVE ID: CVE-2024-49761 State: PUBLISHED Published: 2024-10-28T14:10:23.212Z Last Updated: 2025-11-03T20:41:10.439Z Vendors: ruby Products: rexml Problem Types: CWE-1333 Description: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw
DP Vulnrichment: - CVE Program Container: References: - https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m - https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f - https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
CVE ID: CVE-2024-49762 State: PUBLISHED Published: 2024-10-24T21:39:24.986Z Last Updated: 2024-10-25T17:20:35.873Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: pterodactyl Products: panel Problem Types: CWE-313 Description: Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text. Prior to versio
use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user's account; assuming they are able to discover the account's email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates
to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it's unlikely that their account swill be compromised by this vulnerability, it's not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr - https://github.com/pterodactyl/p
ences: - https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr - https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4 - https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1
CVE ID: CVE-2024-49763 State: PUBLISHED Published: 2024-12-02T16:41:26.846Z Last Updated: 2024-12-02T17:22:07.037Z Vendors: PlexRipper Products: PlexRipper Problem Types: CWE-942 Description: PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker’s domain. This allows an attacking website to access the /api/PlexAccount endpoint and steal the user’s Plex login. This vulnerability is fixed in 0.24.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-305_PlexRipper/ - https://github.com/PlexR
lnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-305_PlexRipper/ - https://github.com/PlexRipper/PlexRipper/commit/184074644a1f5a8ac59519929a9c4b92280fb2a1
CVE ID: CVE-2024-49764 State: PUBLISHED Published: 2024-11-15T15:27:52.199Z Last Updated: 2024-11-15T16:50:01.534Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter when creating a new device. This vulnerability results in the execution of malicious code when the "Capture Debug Information" page is visited, redirecting the user and sending non-ht
xecution of malicious code when the "Capture Debug Information" page is visited, redirecting the user and sending non-httponly cookies to an attacker-controlled domain. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-rmr4-x6c9-jc68 - https://github.com/librenms/librenms/commit/af15eabbb1752985d36f337cecf137a947e170f6
CVE ID: CVE-2024-49765 State: PUBLISHED Published: 2024-12-19T19:15:11.497Z Last Updated: 2024-12-20T20:00:41.125Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-359 Description: Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest version of Discourse. Users unable to upgrade who are using discourse connect may disable all other login methods as a workaround. Additional Analyst Notes: - CISA ADP Vulnrichment:
iscourse connect may disable all other login methods as a workaround. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-v8rf-pvgm-xxf2
CVE ID: CVE-2024-49766 State: PUBLISHED Published: 2024-10-25T19:22:36.380Z Last Updated: 2025-01-31T15:02:48.308Z Vendors: pallets Products: werkzeug Problem Types: CWE-22 Description: Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gi
6 contains a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j - https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092 - https://github.com/pallets/werkzeug/releases/tag/3.0.6
CVE ID: CVE-2024-49767 State: PUBLISHED Published: 2024-10-25T19:41:35.029Z Last Updated: 2025-01-03T12:04:27.829Z Vendors: pallets Products: werkzeug Problem Types: CWE-400, CWE-770 Description: Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper li
ion request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2 - https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee - https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f - https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b - https://github.com/pallets/werkzeug/
tps://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b - https://github.com/pallets/werkzeug/releases/tag/3.0.6
CVE ID: CVE-2024-49768 State: PUBLISHED Published: 2024-10-29T14:32:25.164Z Last Updated: 2024-10-29T14:56:02.111Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Pylons Products: waitress Problem Types: CWE-367, CWE-444 Description: Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is po
equest fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj - https://github.com/Pylons/waitress/
nces: - https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj - https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65
CVE ID: CVE-2024-49769 State: PUBLISHED Published: 2024-10-29T14:18:40.951Z Last Updated: 2024-11-17T00:11:26.954Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Pylons Products: waitress Problem Types: CWE-772 Description: Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attack
it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6 - https://github.com/Pylons/waitress/issues/418 - https://github.com/Pylons/waitress/pull/435 - https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c