Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the corresponding message. When attempting to retrieve messages from the conversation history, the error will continue to occur once the malformed message is part of the result. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/wire-webapp/security/advisories/GHSA-v5mf-358q-w7m4
CVE ID: CVE-2022-39381 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-04-22T16:09:05.431Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: julianhille Products: MuhammaraJS Problem Types: CWE-690 Description: Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. This issue has been patched in 2.6.0 for muhammara and not at all for hummus. As a workaround, do not process file
ther. This issue has been patched in 2.6.0 for muhammara and not at all for hummus. As a workaround, do not process files from untrusted sources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-rcrx-fpjp-mfrw - https://github.com/galkahana/HummusJS/issues/293 - https://github.com/julianhille/MuhammaraJS/issues/191 - https://github.com/julianhille/MuhammaraJS/pull/194
CVE ID: CVE-2022-39382 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-04-22T16:08:20.892Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: keystonejs Products: keystone Problem Types: CWE-74 Description: Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development"` for user code, irrespective of what your environment variables. If you do not use `NODE_ENV` in your user code to trigger security-sensitive functionality, you are not impac
variables. If you do not use `NODE_ENV` in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use `NODE_ENV` to trigger particular behaviors (optimizations, security or otherwise) should still respect your environment's configured `NODE_ENV` variable. The application's dependencies, as found in `node_modules` (including `@keystone-6/core`), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that `NODE_ENV=production yarn keystone start` still uses secure cookies when using `statelessSessions`. This vulnerability has been fixed in @keystone-6/c
tone start` still uses secure cookies when using `statelessSessions`. This vulnerability has been fixed in @keystone-6/core@3.0.2, regression tests have been added for this vulnerability in #8063. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keystonejs/keystone/security/advisories/GHSA-25mx-2mxm-6343 - https://github.com/keystonejs/keystone/pull/8031/ - https://github.com/keystonejs/keystone/pull/8063
CVE ID: CVE-2022-39383 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-23T16:37:02.312Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kubevela Products: kubevela Problem Types: CWE-918 Description: KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're using v1.6, please update the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue. Addit
date the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7 - https://github.com/kubevela/kubevela/pull/5000
CVE ID: CVE-2022-39384 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-04-23T16:40:28.846Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-665 Description: OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support mul
Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible in the scenario described above, breaking the expectation that there is a single execution. Note that upgradeable proxies are commonly initialized together with contract creation, where reentrancy is not feasible, so the impact of this issue is believed to be minor. This issue has been patched, please upgrade to version 4.4.1. As a workaround, avoid untrusted external calls during initialization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-co
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9c22-pwxw-p6hx - https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3006
CVE ID: CVE-2022-39385 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-23T16:37:39.344Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message topics that they should not be added to. They are not notified of this, it happens transparently in the background. This issue has been resolved in commit `a414520742` and will be included in future releases. Users are advised to upgrade. Users are also advised to set `SiteSett
14520742` and will be included in future releases. Users are advised to upgrade. Users are also advised to set `SiteSetting.max_invites_per_day` to 0 until the patch is installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-gh5r-j595-qx48 - https://github.com/discourse/discourse/commit/a414520742da8dc9dc976d4fb7b72dbd445813bb
CVE ID: CVE-2022-39386 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-23T16:39:54.047Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: fastify Products: fastify-websocket Problem Types: CWE-248 Description: @fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the er
nd version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fastify/fastify-websocket/security/advisories/GHSA-4pcg-wr6c-h9cq
CVE ID: CVE-2022-39387 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-04-23T16:40:19.919Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: xwiki-contrib Products: oidc Problem Types: CWE-287 Description: XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the oidc.endpoint.* request parameters (or by using an XWiki-based Open
ltogether by specifying its own provider through the oidc.endpoint.* request parameters (or by using an XWiki-based OpenID provider with oidc.xwikiprovider. With the same approach, one could also provide a specific group mapping through oidc.groups.mapping that would make his user automatically part of the XWikiAdminGroup. This issue has been patched, please upgrade to 1.29.1. There is no workaround, an upgrade of the authenticator is required. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki-contrib/oidc/security/advisories/GHSA-m7gv-v8xx-v47w - https://github.com/xwiki-contrib/oidc/commit/0247af1417925b9734ab106ad7cd934ee870
urity/advisories/GHSA-m7gv-v8xx-v47w - https://github.com/xwiki-contrib/oidc/commit/0247af1417925b9734ab106ad7cd934ee870ac89 - https://jira.xwiki.org/browse/OIDC-118
CVE ID: CVE-2022-39388 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-04-23T16:39:23.029Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: istio Products: istio Problem Types: CWE-863 Description: Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/istio/is
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/istio/istio/security/advisories/GHSA-6c6p-h79f-g6p4 - https://github.com/istio/istio/commit/346260e5115e9fbc65ba8a559bc686e6ca046a32 - https://github.com/istio/istio/commit/9a643e270421560afb2630e00f76d46a55499df9 - https://istio.io/latest/news/releases/1.15.x/announcing-1.15.3/
CVE ID: CVE-2022-39389 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-22T16:07:33.112Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: lightningnetwork Products: lnd Problem Types: CWE-20 Description: Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This ca
and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lightn
ent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr - https://github.com/lightningnetwork/lnd/issues/7096 - https://github.com/lightningnetwork/lnd/pull/7098 - https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta
CVE ID: CVE-2022-39390 State: REJECTED Published: N/A Last Updated: 2022-11-09T00:00:00 Description: No description available.
CVE ID: CVE-2022-39392 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-04-23T16:39:17.281Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-119, CWE-125, CWE-787 Description: Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration, the virtual memory mapping for WebAssembly memories did not meet the compiler-required configuration requirements for safely executing WebAs
apping for WebAssembly memories did not meet the compiler-required configuration requirements for safely executing WebAssembly modules. Wasmtime's default settings require virtual memory page faults to indicate that wasm reads/writes are out-of-bounds, but the pooling allocator's configuration would not create an appropriate virtual memory mapping for this meaning out of bounds reads/writes can successfully read/write memory unrelated to the wasm sandbox within range of the base address of the memory mapping created by the pooling allocator. This bug is not applicable with the default settings of the `wasmtime` crate. This bug can only be triggered by setting `InstanceLimits::memory_pages` t
the default settings of the `wasmtime` crate. This bug can only be triggered by setting `InstanceLimits::memory_pages` to zero. This is expected to be a very rare configuration since this means that wasm modules cannot allocate any pages of linear memory. All wasm modules produced by all current toolchains are highly likely to use linear memory, so it's expected to be unlikely that this configuration is set to zero by any production embedding of Wasmtime. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by increasing the `memory_pages` allotment when configuring the pooling allocator to a value greater than zero. If an embedding wishes to st
emory_pages` allotment when configuring the pooling allocator to a value greater than zero. If an embedding wishes to still prevent memory from actually being used then the `Store::limiter` method can be used to dynamically disallow growth of memory beyond 0 bytes large. Note that the default `memory_pages` value is greater than zero. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-44mr-8vmm-wjhg - https://github.com/bytecodealliance/wasmtime/commit/e60c3742904ccbb3e26da201c9221c38a4981d72
CVE ID: CVE-2022-39393 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-05-02T12:51:28.525Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-226 Description: Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disablin
ance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf - https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0
CVE ID: CVE-2022-39394 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-04-23T16:39:05.163Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-787 Description: Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-b
4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q - https://github.com/bytecodealliance/wasmtime/c
b.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q - https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36
CVE ID: CVE-2022-39395 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-04-23T16:38:58.851Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: go-vela Products: server Problem Types: CWE-269 Description: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to Server 0.16.0, Worker 0.16.0, and UI 0.17.0 to fix the issue. After upgrading, Vela administrators will need to explicitly change the defaul
r 0.16.0, and UI 0.17.0 to fix the issue. After upgrading, Vela administrators will need to explicitly change the default settings to configure Vela as desired. Some of the fixes will interrupt existing workflows and will require Vela administrators to modify default settings. However, not applying the patch (or workarounds) will continue existing risk exposure. Some workarounds are available. Vela administrators can adjust the worker's `VELA_RUNTIME_PRIVILEGED_IMAGES` setting to be explicitly empty, leverage the `VELA_REPO_ALLOWLIST` setting on the server component to restrict access to a list of repositories that are allowed to be enabled, and/or audit enabled repositories and disable pull
rict access to a list of repositories that are allowed to be enabled, and/or audit enabled repositories and disable pull_requests if they are not needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/go-vela/server/security/advisories/GHSA-5m7g-pj8w-7593 - https://github.com/go-vela/ui/security/advisories/GHSA-xf39-98m2-889v - https://github.com/go-vela/worker/security/advisories/GHSA-2w78-ffv6-p46w - https://github.com/go-vela/server/commit/05558ee99d70f7d6f83bed7c8f78ac0b35fa26f4 - https://docs.docker.com/engine/security/#docker-daemon-attack-surface - https://github.com/go-vela/server/releases/tag/v0.16.0 - https://github.com/
ne/security/#docker-daemon-attack-surface - https://github.com/go-vela/server/releases/tag/v0.16.0 - https://github.com/go-vela/ui/releases/tag/v0.17.0 - https://github.com/go-vela/worker/releases/tag/v0.16.0 - https://go-vela.github.io/docs/installation/server/reference/#vela_repo_allowlist - https://go-vela.github.io/docs/installation/worker/reference/#vela_runtime_privileged_images
CVE ID: CVE-2022-39396 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-04-23T16:38:53.154Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-1321 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18. There are no known
ode execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg
CVE ID: CVE-2022-39397 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-23T16:36:30.241Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: tu6ge Products: oss-rs Problem Types: CWE-200 Description: aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tu6ge/oss-rs/security/advisories/GHSA-3w3h-7xgx-grwc - https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb073943387796df29
CVE ID: CVE-2022-39398 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-04-23T16:38:47.048Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L) Vendors: InfotelGLPI Products: tasklists Problem Types: CWE-79 Description: tasklists is a tasklists plugin for GLPI (Kanban). Versions prior to 2.0.3 are vulnerable to Cross-site Scripting. Cross-site Scripting (XSS) - Create XSS in task content (when add it). This issue is patched in version 2.0.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/InfotelGLPI/tasklists/security/advisories/GHSA-3qv3-8393-777q - https:/
P Vulnrichment: References: - https://github.com/InfotelGLPI/tasklists/security/advisories/GHSA-3qv3-8393-777q - https://github.com/InfotelGLPI/tasklists/commit/4a1b30f3d9fa764695f98ce011c8542772530d47
CVE ID: CVE-2022-39399 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-02-13T16:33:00.807Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Oracle Corporation Products: Java SE JDK and JRE Problem Types: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Description: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle J