Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-23205 State: PUBLISHED Published: 2025-01-17T20:23:21.818Z Last Updated: 2025-02-06T21:29:22.409Z Vendors: jupyter Products: nbgrader Problem Types: CWE-668 Description: nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because
g formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice's page is on the same Origin as the formgrader iframe, Javasript on Alice's page has _full access_ to the contents of the page served by formgrader using Bob's credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame). Additional Analyst Notes: - CISA ADP Vulnrichment:
ed, the host page does not have access to the contents of the frame). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jupyter/nbgrader/security/advisories/GHSA-fcr8-4r9f-r66m - https://github.com/jupyter/nbgrader/pull/1915 - https://github.com/jupyter/nbgrader/commit/73e137511ac1dc02e95790d4fd6d4d88dab42325 - https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#:~:text=frame-ancestors
CVE ID: CVE-2025-23206 State: PUBLISHED Published: 2025-01-17T20:34:50.851Z Last Updated: 2025-01-17T20:59:59.266Z Vendors: aws Products: aws-cdk Problem Types: CWE-347 Description: The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow. However, the current `tls.connect` method will always set `rejectUnauthorized: false` which is a potential security concern. CDK should follow the best practice and set `rejectUnauthorized: true`. However, this could be
tential security concern. CDK should follow the best practice and set `rejectUnauthorized: true`. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag. Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack. The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22). Once upgraded, users should make sure the feature flag '@aws-cdk/
de to CDK v2.177.0 (Expected release date 2025-02-22). Once upgraded, users should make sure the feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in `cdk.context.json` or `cdk.json`. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73 - https://github.com/aws/aws-cdk/issues/32920 - https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34
CVE ID: CVE-2025-23207 State: PUBLISHED Published: 2025-01-17T21:25:05.746Z Last Updated: 2025-01-17T21:32:24.984Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: KaTeX Products: KaTeX Problem Types: CWE-116 Description: KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `
ve this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546 - https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c
CVE ID: CVE-2025-23208 State: PUBLISHED Published: 2025-01-17T22:24:09.406Z Last Updated: 2025-01-22T14:27:12.141Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: project-zot Products: zot Problem Types: CWE-269 Description: zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot config
onflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/project-zot/zot/security/advisories/GHSA-c9p4-xwr9-rfhx - https://github.com/project-zot/zot/commit/002ac62d8a15bf0cba010b3ba7bde86f9837b613 - https://github.com/project-zot/zot/blob/5e30fec65c49e3139907e2819ccb39b2e3bd784e/pkg/meta/boltdb/boltdb.go#L1665
CVE ID: CVE-2025-23209 State: PUBLISHED Published: 2025-01-18T00:32:54.954Z Last Updated: 2025-10-21T22:55:31.434Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: craftcms Products: cms Problem Types: CWE-94 Description: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, sho
fected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x - https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603 - https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret
CVE ID: CVE-2025-23210 State: PUBLISHED Published: 2025-02-03T21:14:57.255Z Last Updated: 2025-02-04T15:33:39.661Z Vendors: PHPOffice Products: PhpSpreadsheet Problem Types: CWE-79 Description: phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadshee
lnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r57h-547h-w24f - https://github.com/PHPOffice/PhpSpreadsheet/commit/cde2926a9e2baf146783f8fd1771bbed7d1dc7b3
CVE ID: CVE-2025-23211 State: PUBLISHED Published: 2025-01-28T15:24:27.397Z Last Updated: 2025-01-28T16:15:33.081Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: TandoorRecipes Products: recipes Problem Types: CWE-1336 Description: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-r6rj-h75w-vj8v - https:/
Vulnrichment: References: - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-r6rj-h75w-vj8v - https://github.com/TandoorRecipes/recipes/commit/e6087d5129cc9d0c24278948872377e66c2a2c20 - https://github.com/TandoorRecipes/recipes/blob/4f9bff20c858180d0f7376de443a9fe4c123a50c/cookbook/helper/template_helper.py#L95
CVE ID: CVE-2025-23212 State: PUBLISHED Published: 2025-01-28T15:29:07.948Z Last Updated: 2025-01-28T16:10:06.786Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: TandoorRecipes Products: recipes Problem Types: CWE-200 Description: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-jrgj-35jx-2qq7 - https://github.com/TandoorRecipes/recipes/co
github.com/TandoorRecipes/recipes/security/advisories/GHSA-jrgj-35jx-2qq7 - https://github.com/TandoorRecipes/recipes/commit/36e83a9d0108ac56b9538b45ead57efc8b97c5ff
CVE ID: CVE-2025-23213 State: PUBLISHED Published: 2025-01-28T15:31:19.544Z Last Updated: 2025-01-28T15:51:05.550Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: TandoorRecipes Products: recipes Problem Types: CWE-434 Description: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-56jp-j3x5-hh2w - https://github
chment: References: - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-56jp-j3x5-hh2w - https://github.com/TandoorRecipes/recipes/commit/3e37d11c6a3841a00eb27670d1d003f1a713e1cf
CVE ID: CVE-2025-23214 State: PUBLISHED Published: 2025-01-20T18:09:45.996Z Last Updated: 2025-02-12T20:41:20.065Z Vendors: azukaar Products: Cosmos-Server Problem Types: CWE-204 Description: Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out whether a user exist or not in the database. Patched in 0.17.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5843-2p4f-57fh - https://github.com/azukaar/Cosmos-Server/commit/ef643b4882b0ec074f4021d52583c
/security/advisories/GHSA-5843-2p4f-57fh - https://github.com/azukaar/Cosmos-Server/commit/ef643b4882b0ec074f4021d52583c7c00eac4691
CVE ID: CVE-2025-23215 State: PUBLISHED Published: 2025-01-31T15:25:53.026Z Last Updated: 2025-04-04T21:08:48.961Z Vendors: pmd Products: pmd Problem Types: CWE-200, CWE-540, CWE-312 Description: PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered potentially compromised. As a mitigation, both compromised keys have been revoked so that no future use of the keys are possible. Note, that the published artifacts in Maven Central under the group id net.sour
no future use of the keys are possible. Note, that the published artifacts in Maven Central under the group id net.sourceforge.pmd are not compromised and the signatures are valid. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pmd/pmd/security/advisories/GHSA-88m4-h43f-wx84 - https://github.com/pmd/pmd-designer/commit/1548f5f27ba2981b890827fecbd0612fa70a0362 - https://github.com/pmd/pmd-designer/commit/e87a45312753ec46b3e5576c6f6ac1f7de2f5891
CVE ID: CVE-2025-23216 State: PUBLISHED Published: 2025-01-30T15:30:05.405Z Last Updated: 2025-02-12T19:51:12.285Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: argoproj Products: argo-cd Problem Types: CWE-209, CWE-200 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository an
repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v - https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 - https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca
CVE ID: CVE-2025-23217 State: PUBLISHED Published: 2025-02-06T17:32:30.226Z Last Updated: 2025-02-12T19:51:08.896Z Vendors: mitmproxy Products: mitmproxy Problem Types: CWE-288, CWE-441 Description: mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server (bound to `*:8080` by default) to access mitmweb's internal API (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style ac
cess the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-wg33-5h85-7q5p - https://en.wikipedia.org/wiki/Server-side_request_forgery - https://github.com/mitmproxy/mitmproxy/blob/main/CHANGELOG.md#06-february-2025-mitmproxy-1112
CVE ID: CVE-2025-23218 State: PUBLISHED Published: 2025-01-20T15:45:52.680Z Last Updated: 2025-02-18T20:11:26.560Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_especie.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This v
it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xhv4-88gx-hvgh - https://github.com/LabRedesCefetRJ/WeGIA/commit/7465f785651c0cff65059bba96b015ab54235de4
CVE ID: CVE-2025-23219 State: PUBLISHED Published: 2025-01-20T15:47:39.681Z Last Updated: 2025-02-18T20:44:42.129Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_cor.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulne
was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-h2mg-4c7q-w69v - https://github.com/LabRedesCefetRJ/WeGIA/commit/ae9c859006143bd0087b3e6e48a0677e1fff5c7e
CVE ID: CVE-2025-23220 State: PUBLISHED Published: 2025-01-20T15:48:36.049Z Last Updated: 2025-02-18T20:43:59.453Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_raca.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vuln
was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-425j-h4cf-g52j - https://github.com/LabRedesCefetRJ/WeGIA/commit/1739e1589948a207b8a82b9bfe078cb826d420de
CVE ID: CVE-2025-23221 State: PUBLISHED Published: 2025-01-20T16:49:31.738Z Last Updated: 2025-01-21T14:49:49.806Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: dahlia Products: fedify Problem Types: CWE-835, CWE-918 Description: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service. Moreover, this issue can also be maneuvered in
cing the victim’s server into an infinite loop causing Denial of Service. Moreover, this issue can also be maneuvered into performing a Blind SSRF attack. This vulnerability is fixed in 1.0.14, 1.1.11, 1.2.11, and 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx - https://github.com/dahlia/fedify/commit/8be3c2038eebf4ae12481683a1e809b314be3151 - https://github.com/dahlia/fedify/commit/c505eb82fcd6b5b17174c6659c29721bc801ab9a - https://github.com/dahlia/fedify/commit/e921134dd5097586e4563ea80b9e8d1b5460a645
CVE ID: CVE-2025-23222 State: PUBLISHED Published: 2025-01-24T00:00:00.000Z Last Updated: 2025-02-12T20:41:30.901Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Deepin Products: dde-api-proxy Problem Types: CWE-940 Description: An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shou
he proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1229918 - https://www.openwall.com/lists/oss-security/2025/01/24/3 - https://security.opensuse.org/2025/01/24/dde-api-proxy-privilege-escalation.html
CVE ID: CVE-2025-23225 State: PUBLISHED Published: 2025-02-28T02:23:30.753Z Last Updated: 2025-02-28T16:34:10.887Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Problem Types: CWE-230 Description: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user to cause a denial of service due to the improper handling of invalid headers sent to the queue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183372
CVE ID: CVE-2025-23227 State: PUBLISHED Published: 2025-01-23T17:19:35.814Z Last Updated: 2025-02-01T13:39:24.186Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Tivoli Application Dependency Discovery Manager Problem Types: CWE-79 Description: IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
entials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7181334
CVE ID: CVE-2025-23233 State: PUBLISHED Published: 2025-05-13T21:02:48.065Z Last Updated: 2025-05-15T04:01:54.053Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform Problem Types: Escalation of Privilege, CWE-279 Description: Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01239.html