Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-53967 State: PUBLISHED Published: 2025-03-19T16:10:16.046Z Last Updated: 2025-03-19T17:39:11.647Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code in the context of the victim's browser session. By manipulating the DOM environment in the victim's browser, a low privileged attacker can inject malicious scripts that are executed by the victim's browser. Exploitation of this issue requires user interac
can inject malicious scripts that are executed by the victim's browser. Exploitation of this issue requires user interaction, typically in the form of following a malicious link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-53968 State: PUBLISHED Published: 2025-03-19T16:10:07.453Z Last Updated: 2025-03-19T17:50:30.600Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code in the context of the victim's browser session. By manipulating the DOM environment in the victim's browser, a low privileged attacker can inject malicious scripts that are executed by the victim's browser. Exploitation of this issue requires user interac
CVE ID: CVE-2024-53969 State: PUBLISHED Published: 2025-03-19T16:09:58.440Z Last Updated: 2025-03-19T18:12:07.758Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code in the context of the victim's browser session. By manipulating the DOM environment in the victim's browser, a low privileged attacker can inject malicious scripts that are executed by the victim's browser. Exploitation of this issue requires user interac
CVE ID: CVE-2024-53970 State: PUBLISHED Published: 2025-03-19T16:09:40.903Z Last Updated: 2025-03-19T18:15:10.837Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2024-53974 State: PUBLISHED Published: 2025-02-19T17:31:00.945Z Last Updated: 2025-02-19T18:18:48.136Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2024-53975 State: PUBLISHED Published: 2024-11-26T13:34:07.725Z Last Updated: 2025-10-28T14:34:17.428Z Vendors: Mozilla Products: Firefox for iOS Problem Types: SSL security padlock icon could be visually spoofed to look secure on an HTTP page Description: Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. This vulnerability affects Firefox for iOS < 133. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1843467 - https://www.mozilla.org/security/advisories/mfsa2024-66/
CVE ID: CVE-2024-53976 State: PUBLISHED Published: 2024-11-26T13:34:07.977Z Last Updated: 2024-11-26T15:28:52.539Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Missing address from location URL bar Description: Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the loaded webpage. This vulnerability affects Firefox for iOS < 133. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1905749 - https://www.mozilla.org/security/advisories/mfsa2024-66/
CVE ID: CVE-2024-53977 State: PUBLISHED Published: 2025-02-11T10:28:56.961Z Last Updated: 2025-02-11T14:33:10.686Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: ModelSim, Questa Problem Types: CWE-427 Description: A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example setup script contained in affected applications allows a specific executable file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges in installations where administrators or processes with elevated privileges launch th
trary code and escalate privileges in installations where administrators or processes with elevated privileges launch the script from a user-writable directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-637914.html
CVE ID: CVE-2024-53979 State: PUBLISHED Published: 2024-11-29T18:50:31.398Z Last Updated: 2024-12-04T17:19:36.207Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: zhmcclient Products: zhmc-ansible-modules Problem Types: CWE-312 Description: ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file and into the output returned by some of its Ansible module in the following cases: 1. The 'boot_ftp_password' and 'ssc_master_pw' properties are passed as input to the zhmc_partition Ansible module. 2. The 'ssc_master_pw' and 'zaware_master_pw' properties are passed a
sed as input to the zhmc_partition Ansible module. 2. The 'ssc_master_pw' and 'zaware_master_pw' properties are passed as input to the zhmc_lpar Ansible module. 3. The 'password' property is passed as input to the zhmc_user Ansible module (just in log file, not in module output). 4. The 'bind_password' property is passed as input to the zhmc_ldap_server_definition Ansible module. These properties appear in the module output only when they were specified in the module input and when creating or updating the corresponding resources. They do not appear in the output when retrieving facts for the corresponding resources. These properties appear in the log file only when the "log_file" module inp
eving facts for the corresponding resources. These properties appear in the log file only when the "log_file" module input parameter is used. By default, no log file is created. This issue has been fixed in ibm.ibm_zhmc version 1.9.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zhmcclient/zhmc-ansible-modules/security/advisories/GHSA-mw6c-f428-jx4f - https://github.com/zhmcclient/zhmc-ansible-modules/commit/f5579f07da5f02d2496c41a313d4ae7a0a459b1d
CVE ID: CVE-2024-53980 State: PUBLISHED Published: 2024-11-29T18:56:57.584Z Last Updated: 2024-12-02T11:06:19.121Z Vendors: RIOT-OS Products: RIOT Problem Types: CWE-835 Description: RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A malicious actor can send a IEEE 802.15.4 packet with spoofed length byte and optionally spoofed FCS, which eventually results into an endless loop on a CC2538 as receiver. Before PR #20998, the receiver would check for the location of the CRC bit using the packet length byte by considering all 8 bits, instead of discarding bit 7, which is what the radio doe
CRC bit using the packet length byte by considering all 8 bits, instead of discarding bit 7, which is what the radio does. This then results into reading outside of the RX FIFO. Although it prints an error when attempting to read outside of the RX FIFO, it will continue doing this. This may lead to a discrepancy in the CRC check according to the firmware and the radio. If the CPU judges the CRC as correct and the radio is set to `AUTO_ACK`, when the packet requests and acknowledgment the CPU will go into the state `CC2538_STATE_TX_ACK`. However, if the radio judged the CRC as incorrect, it will not send an acknowledgment, and thus the `TXACKDONE` event will not fire. It will then never retur
as incorrect, it will not send an acknowledgment, and thus the `TXACKDONE` event will not fire. It will then never return to the state `CC2538_STATE_READY` since the baseband processing is still disabled. Then the CPU will be in an endless loop. Since setting to idle is not forced, it won't do it if the radio's state is not `CC2538_STATE_READY`. A fix has not yet been made. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m75q-8vj8-wppw - https://github.com/RIOT-OS/RIOT/pull/20998 - https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L183 - https://github.
RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L183 - https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L417 - https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L419 - https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/cpu/cc2538/radio/cc2538_rf_radio_ops.c#L421-L422 - https://github.com/RIOT-OS/RIOT/blob/1a418ccfedeb79dbce1d79f49e63a28906184794/sys/net/link_layer/ieee802154/submac.c#L149
CVE ID: CVE-2024-53981 State: PUBLISHED Published: 2024-12-02T15:57:50.232Z Last Updated: 2024-12-02T19:59:14.830Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Kludex Products: python-multipart Problem Types: CWE-770 Description: python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or aft
or certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3 - https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177
CVE ID: CVE-2024-53982 State: PUBLISHED Published: 2024-12-04T22:20:53.986Z Last Updated: 2024-12-05T18:48:13.359Z Vendors: ZOO-Project Products: ZOO-Project Problem Types: CWE-434 Description: ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is performed in this parameter, which allows an attacker to fully control the file which is returned in the response. Patch was committed in November 22nd, 2024. Additional Analyst Notes: - CISA ADP Vulnrichment:
returned in the response. Patch was committed in November 22nd, 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-93rv-45r8-h5j4 - https://github.com/ZOO-Project/ZOO-Project/commit/641cb18fec58de43a3468f314e5f8808c560e6d9
CVE ID: CVE-2024-53983 State: PUBLISHED Published: 2024-11-29T18:53:13.289Z Last Updated: 2024-12-02T22:16:09.994Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: backstage Products: backstage Problem Types: CWE-918 Description: The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive res
e privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
nsure that templates do not change git config. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9 - https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
CVE ID: CVE-2024-53984 State: PUBLISHED Published: 2024-12-02T15:54:47.478Z Last Updated: 2024-12-02T21:40:02.909Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: nanopb Products: nanopb Problem Types: CWE-401, CWE-755 Description: Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field with FT_POINTER field type, custom stream callback is used with unknown stream length. and the pb_decode_ex() function is used with flag PB_DECODE_DELIMITED, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This
D, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This could lead to memory leak and potential denial-of-service. This vulnerability is fixed in 0.4.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanopb/nanopb/security/advisories/GHSA-xwqq-qxmw-hj5r - https://github.com/nanopb/nanopb/commit/2b86c255aa52250438d5aba124d0e86db495b378
CVE ID: CVE-2024-53985 State: PUBLISHED Published: 2024-12-02T21:15:57.620Z Last Updated: 2024-12-11T16:47:59.133Z Vendors: rails Products: rails-html-sanitizer Problem Types: CWE-79 Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and
sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and "style" elements or both both "svg" and "style" elements. This vulnerability is fixed in 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x - https://github.com/rails/rails-html-sanitizer/commit/b0220b8850d52199a15f83c472d175a4122dd7b1 - https://github.com/rails/rails-html-sanitizer/commit/cd18b0ef00aad1d4a9e1c5d860cd23f80f63c505
CVE ID: CVE-2024-53986 State: PUBLISHED Published: 2024-12-02T21:13:01.441Z Last Updated: 2024-12-03T14:33:51.139Z Vendors: rails Products: rails-html-sanitizer Problem Types: CWE-79 Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitl
plication developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This vulnerability is fixed in 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48 - https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
CVE ID: CVE-2024-53987 State: PUBLISHED Published: 2024-12-02T21:15:48.975Z Last Updated: 2024-12-03T14:33:22.284Z Vendors: rails Products: rails-html-sanitizer Problem Types: CWE-79 Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the
plication developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the "svg" or "math" element is not allowed. This vulnerability is fixed in 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr - https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
CVE ID: CVE-2024-53988 State: PUBLISHED Published: 2024-12-02T21:09:56.440Z Last Updated: 2024-12-03T14:34:23.054Z Vendors: rails Products: rails-html-sanitizer Problem Types: CWE-79 Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements
plication developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are allowed and either either "mglyph" or "malignmark" are allowed. This vulnerability is fixed in 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cfjx-w229-hgx5 - https://github.com/rails/rails-html-sanitizer/commit/a0a3e8b76b696446ffc6bffcff3bc7b7c6393c72
CVE ID: CVE-2024-53989 State: PUBLISHED Published: 2024-12-02T21:07:04.296Z Last Updated: 2024-12-03T14:35:25.922Z Vendors: rails Products: rails-html-sanitizer Problem Types: CWE-79 Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags for the the "noscript" element. This vulnerability is fi
plication developer has overridden the sanitizer's allowed tags for the the "noscript" element. This vulnerability is fixed in 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rxv5-gxqc-xx8g - https://github.com/rails/rails-html-sanitizer/commit/16251735e36ebdc302e2f90f2a39cad56879414f
CVE ID: CVE-2024-53990 State: PUBLISHED Published: 2024-12-02T17:10:28.229Z Last Updated: 2024-12-04T17:08:11.472Z Vendors: AsyncHttpClient Products: async-http-client Problem Types: CWE-287 Description: The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests. Additional Analyst Notes: - CISA
le users, this can result in one user's Cookie being used for another user's requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj5-cf8g-g2fv - https://github.com/AsyncHttpClient/async-http-client/issues/1964 - https://github.com/AsyncHttpClient/async-http-client/pull/2033 - https://github.com/AsyncHttpClient/async-http-client/commit/d5a83362f7aed81b93ebca559746ac9be0f95425
CVE ID: CVE-2024-53991 State: PUBLISHED Published: 2024-12-19T19:11:20.590Z Last Updated: 2024-12-20T20:43:11.036Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request. This issue is patched in the latest stable, beta and tests-passed
the Discourse backup file with a well crafted request. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. Users unable to upgrade can either 1. Download all local backups on to another storage device, disable the `enable_backups` site setting and delete all backups until the site has been upgraded to pull in the fix. Or 2. Change the `backup_location` site setting to `s3` so that backups are stored and downloaded directly from S3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-567m-82f6-56rv