Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-9465 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.411Z Vendors: n/a Products: Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 Problem Types: CWE-79 Description: Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: Ref
ge content this is prone to a stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=nc-sa-2016-008 - https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58e - https://hackerone.com/reports/163338 - https://owncloud.org/security/advisory/?id=oc-sa-2016-018 - https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0 - https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845
CVE ID: CVE-2016-9466 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.485Z Vendors: n/a Products: Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 Problem Types: CWE-79 Description: Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http
to a reflected Cross-Site-Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=nc-sa-2016-009 - https://github.com/nextcloud/gallery/commit/f9ef505c1d60c9041e251682e0f6b3daad952d58 - https://hackerone.com/reports/165686 - https://owncloud.org/security/advisory/?id=oc-sa-2016-019 - https://github.com/owncloud/gallery/commit/dc4887f1afcc0cf304f4a0694075c9364298ad8a - https://github.com/owncloud/gallery/commit/b3b3772fb9bec61ba10d357bef42b676fa474eee
CVE ID: CVE-2016-9467 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.429Z Vendors: n/a Products: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 Problem Types: CWE-451 Description: Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user. Additional Analyst Notes: - CVE Program Container: References: -
play an attacker-controlled error message to the user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/server/commit/5dd211cc8845fd4533966bf8d7a7f2a6359ea013 - https://github.com/nextcloud/server/commit/ed0f0db5fa0aff04594cb0f973ae4c22b17a175a - https://nextcloud.com/security/advisory/?id=nc-sa-2016-010 - https://github.com/nextcloud/server/commit/df50e967dbd27b13875625b7dd3189294619b071 - https://github.com/owncloud/core/commit/768221fcf3c526c65d85f62b0efa2da5ea00bf2d - https://github.com/owncloud/core/commit/e7acbce27fa0ef1c6fe216ca67c72d86484919a4 - https://github.com/nextcloud/server/commit/c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14 - https://h
e216ca67c72d86484919a4 - https://github.com/nextcloud/server/commit/c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14 - https://hackerone.com/reports/154827 - https://github.com/nextcloud/server/commit/1352365e8bf5ea49da3dc82b1ccf7ddb659ae960 - https://github.com/nextcloud/server/commit/778ae8abd54c378fc4781394bbedc7a2ee3095e1 - https://owncloud.org/security/advisory/?id=oc-sa-2016-020
CVE ID: CVE-2016-9468 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.587Z Vendors: n/a Products: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 Problem Types: CWE-451 Description: Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2016-021 - https:/
nalyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2016-021 - https://github.com/nextcloud/server/commit/a4cfb3ddc1f4cdb585e05c0e9b2f8e52a0e2ee3e - https://github.com/nextcloud/server/commit/7350e13113c8ed484727a5c25331ec11d4d59f5f - https://github.com/owncloud/core/commit/96b8afe48570bc70088ccd8f897e9d71997d336e - https://hackerone.com/reports/149798 - https://github.com/owncloud/core/commit/bcc6c39ad8c22a00323a114e9c1a0a834983fb35 - https://nextcloud.com/security/advisory/?id=nc-sa-2016-011
CVE ID: CVE-2016-9469 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.683Z Vendors: n/a Products: GitLab Community Edition & GitLab Enterprise Edition 8.13.0, 8.13.0-ee, 8.13.1, 8.13.1-ee, 8.13.2, 8.13.2-ee, 8.13.3, 8.13.3-ee, 8.13.4, 8.13.4-ee, 8.13.5, 8.13.5-ee, 8.13.6, 8.13.6-ee, 8.13.7, 8.14.0, 8.14.0-ee, 8.14.1 Problem Types: CWE-749 Description: Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix was included i
with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix was included in versions 8.14.3, 8.13.8, and 8.12.11, which were released on December 5th 2016 at 3:59 PST. The GitLab versions vulnerable to this are 8.13.0, 8.13.0-ee, 8.13.1, 8.13.1-ee, 8.13.2, 8.13.2-ee, 8.13.3, 8.13.3-ee, 8.13.4, 8.13.4-ee, 8.13.5, 8.13.5-ee, 8.13.6, 8.13.6-ee, 8.13.7, 8.14.0, 8.14.0-ee, 8.14.1, 8.14.2, and 8.14.2-ee. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/commit/f325e4e734e5e486f3b02db176eb629124052b43 - https://gitlab.com/gitlab-org/gitlab-ce/commit/55196497301eea429913f9c4b1b37c42c2e358ce - https:/
2db176eb629124052b43 - https://gitlab.com/gitlab-org/gitlab-ce/commit/55196497301eea429913f9c4b1b37c42c2e358ce - https://about.gitlab.com/2016/12/05/cve-2016-9469/ - https://hackerone.com/reports/186194 - https://gitlab.com/gitlab-org/gitlab-ce/issues/25064 - https://gitlab.com/gitlab-org/gitlab-ce/commit/29ceb98b5162677601702704e89d845580372078
CVE ID: CVE-2016-9470 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.406Z Vendors: n/a Products: Revive Adserver All versions before 3.2.5 and 4.0.0 Problem Types: CWE-79 Description: Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/revive-adserver/revive-adserver/commit/69aacbd2 - https://hackerone.com/reports/1487
r: References: - https://github.com/revive-adserver/revive-adserver/commit/69aacbd2 - https://hackerone.com/reports/148745 - https://www.revive-adserver.com/security/revive-sa-2016-002/
CVE ID: CVE-2016-9471 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.437Z Vendors: n/a Products: Revive Adserver All versions before 3.2.5 and 4.0.0 Problem Types: CWE-75 Description: Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fact that such characters are normally ignored when an HTML page is displayed in a browser. The issue could have therefore been exploited for user spoofing, although elevated privileges
s displayed in a browser. The issue could have therefore been exploited for user spoofing, although elevated privileges are required to create users within Revive Adserver. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/128181 - https://github.com/revive-adserver/revive-adserver/commit/05b1eceb - https://www.revive-adserver.com/security/revive-sa-2016-002/
CVE ID: CVE-2016-9472 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.460Z Vendors: n/a Products: Revive Adserver All versions before 3.2.5 and 4.0.0 Problem Types: CWE-79 Description: Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost, dbUser, and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narrow and it is very unlikely that such an attack could be actually effective. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/revive-adserver/revive-a
effective. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/revive-adserver/revive-adserver/commit/fcf72c8a - https://hackerone.com/reports/170156 - https://github.com/revive-adserver/revive-adserver/commit/14ff73f0 - https://www.revive-adserver.com/security/revive-sa-2016-002/
CVE ID: CVE-2016-9473 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:50:38.697Z Vendors: n/a Products: Brave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier Problem Types: CWE-451 Description: Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brave/browser-ios/pull/504 - https://cxsecurity.com/issue/WLB-2017010042 - https://hackerone.com/reports/175958 - http://www.securityfocus.com/
504 - https://cxsecurity.com/issue/WLB-2017010042 - https://hackerone.com/reports/175958 - http://www.securityfocus.com/bid/97155
CVE ID: CVE-2016-9474 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9475 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9476 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9477 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9478 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9479 State: PUBLISHED Published: 2016-12-02T16:00:00 Last Updated: 2024-08-06T02:50:38.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://b2evolution.net/downloads/6-7-9-stable - http://www.securitytracker.com/id/1037393 - https://github.com/b2evolution/b2evolution/issues/33 - http://www.securityfocus.com/bid/95006
CVE ID: CVE-2016-9480 State: PUBLISHED Published: 2016-11-29T23:00:00 Last Updated: 2024-08-06T02:50:38.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approach, related to a "Heap Buffer Over-read" issue affecting the dwarf_util.c component, aka DW201611-006. Additional Analyst Notes: - CVE Program Container: References: - https://www.prevanders.net/dwarfbug.html - https://sourceforge.net/p/libdwarf/code/ci/5dd64de047cd5ec479fb11fe7ff2692fd819e5e5/ - https://sourceforge.net/p/libdwarf/bugs/5/ - http://www.securityfocus.com/bi
5dd64de047cd5ec479fb11fe7ff2692fd819e5e5/ - https://sourceforge.net/p/libdwarf/bugs/5/ - http://www.securityfocus.com/bid/94980
CVE ID: CVE-2016-9481 State: PUBLISHED Published: 2016-11-29T23:00:00 Last Updated: 2024-08-06T02:50:38.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this->params['content_id']' used directly in SQL. Impact is a SQL injection. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037368 - http://www.securityfocus.com/bid/94590 - http://www.pang0lin.com/?p=1076
CVE ID: CVE-2016-9482 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T02:50:38.590Z Vendors: PHP FormMail Products: Generator Problem Types: CWE-302 Description: Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/494015 - http://www.securityfocus.com/bid/94778
CVE ID: CVE-2016-9483 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T02:50:38.589Z Vendors: PHP FormMail Products: Generator Problem Types: CWE-502 Description: The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obtain files from the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/494015 - http://www.securityfocus.com/bid/94778
CVE ID: CVE-2016-9484 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T02:50:38.369Z Vendors: PHP FormMail Products: Generator Problem Types: CWE-22 Description: The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/494015 - http://www.securityfocus.com/bid/
Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/494015 - http://www.securityfocus.com/bid/94778
CVE ID: CVE-2016-9485 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T02:50:38.434Z Vendors: Microsoft Products: Windows SecureConnector agent Problem Types: CWE-378 Description: On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads t
ther and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads these scripts and executables as needed from the CounterACT management appliance and runs them on the endpoint. The SecureConnector agent fails to set any permissions on downloaded file objects. This allows a malicious user to take ownership of any of these files and make modifications to it, regardless of where the files are saved. These files are then executed under SYSTEM privileges. A malicious unprivileged user can overwrite these executable files with malicious code before the SecureConnector agent executes them, causing the malicious code to be run under the SYSTEM ac
malicious code before the SecureConnector agent executes them, causing the malicious code to be run under the SYSTEM account. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/768331 - http://www.securityfocus.com/bid/94740
CVE ID: CVE-2016-9486 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T02:50:38.432Z Vendors: Microsoft Products: Windows SecureConnector agent Problem Types: CWE-379 Description: On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads t
ther and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads these scripts and executables as needed from the CounterACT management appliance and runs them on the endpoint. By default, these executable files are downloaded to and run from the %TEMP% directory of the currently logged on user, despite the fact that the SecureConnector agent is running as SYSTEM. Aside from the downloaded scripts, the SecureConnector agent runs a batch file with SYSTEM privileges from the temp directory of the currently logged on user. If the naming convention of this script can be derived, which is made possible by placing it in a directory to which the
If the naming convention of this script can be derived, which is made possible by placing it in a directory to which the user has read access, it may be possible overwrite the legitimate batch file with a malicious one before SecureConnector executes it. It is possible to change this directory by setting the the configuration property config.script_run_folder.value in the local.properties configuration file on the CounterACT management appliance, however the batch file which is run does not follow this property. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/768331 - http://www.securityfocus.com/bid/94740
CVE ID: CVE-2016-9487 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T02:50:38.360Z Vendors: EpubCheck Products: EpubCheck Problem Types: CWE-611 Description: EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/779243 - https://www.securityfocus.com/bid/94864/
CVE ID: CVE-2016-9488 State: PUBLISHED Published: 2018-06-05T14:00:00 Last Updated: 2024-08-06T02:50:38.390Z Vendors: ManageEngine Products: Applications Manager Problem Types: CWE-89 Description: ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries. Additional Analyst Notes: - CVE Program Container:
ion, could also execute operating system commands using SQL queries. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/9 - https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9488.html - http://www.securityfocus.com/bid/97394 - http://packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.html
CVE ID: CVE-2016-9489 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T02:50:38.431Z Vendors: ManageEngine Products: Applications Manager Problem Types: CWE-269 Description: In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9489.html - ht
: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9489.html - http://seclists.org/fulldisclosure/2017/Apr/9 - https://www.securityfocus.com/bid/97394/
CVE ID: CVE-2016-9490 State: PUBLISHED Published: 2018-06-05T14:00:00 Last Updated: 2024-08-06T02:50:38.424Z Vendors: ManageEngine Products: Applications Manager Problem Types: CWE-79 Description: ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/9 - https://packetstormsecurity.com/files/142022/ManageEngine-App
erences: - http://seclists.org/fulldisclosure/2017/Apr/9 - https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9490.html - http://www.securityfocus.com/bid/97394
CVE ID: CVE-2016-9491 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T02:50:38.580Z Vendors: ManageEngine Products: Applications Manager Problem Types: CWE-611 Description: ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system. Additional Analyst Notes: - CVE Program Cont