Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-37462 State: PUBLISHED Published: 2023-07-14T20:39:05.941Z Last Updated: 2024-10-30T18:31:34.487Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-74, CWE-95 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write a
cript macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations. Additional Analyst Notes: - CVE Pro
heet` and users unable to upgrade are advised to manually patch their installations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4vp-69r8-gvjg - https://github.com/xwiki/xwiki-platform/commit/d9c88ddc4c0c78fa534bd33237e95dea66003d29 - https://jira.xwiki.org/browse/XWIKI-20457
CVE ID: CVE-2023-37463 State: PUBLISHED Published: 2023-07-13T19:22:16.654Z Last Updated: 2024-10-30T18:48:32.341Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: github Products: cmark-gfm Problem Types: CWE-400 Description: cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/
12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5 - https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12
CVE ID: CVE-2023-37464 State: PUBLISHED Published: 2023-07-14T20:25:18.264Z Last Updated: 2025-02-13T17:01:27.231Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: OpenIDC Products: cjose Problem Types: CWE-327 Description: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users
e a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenIDC/cjose/security/advisories/GHSA-3rhg-3gf2-6xgj - https://github.com/OpenIDC/cjose/commit/7325e9a5e71e2fc0e350487ecac7d84acdf0ed5e - https://datatracker.ietf.org/doc/html/rfc7518#section-4.7 - https://github.com/OpenIDC/cjose/releases/tag/v0.6.2.2 - https://lists.debian.org/debian-lts-announce/2023/08/msg00002.html - https://www.debian.org/se
e/releases/tag/v0.6.2.2 - https://lists.debian.org/debian-lts-announce/2023/08/msg00002.html - https://www.debian.org/security/2023/dsa-5472 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFWAPMYYVBO2U65HPYDTBEKNSXG4TP5C/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTZHOVGY7AHGNMEY245HK4Q36AMA53AL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCQJXKDPCWCXB2V4JMQ3UWYJ4UIBPUW6/
CVE ID: CVE-2023-37466 State: PUBLISHED Published: 2023-07-13T23:17:51.434Z Last Updated: 2025-11-03T21:48:53.572Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: patriksimek Products: vm2 Problem Types: CWE-94 Description: vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sand
to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
CVE ID: CVE-2023-37467 State: PUBLISHED Published: 2023-07-28T14:42:06.159Z Last Updated: 2024-10-10T16:07:05.366Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: discourse Products: discourse Problem Types: CWE-323 Description: Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to by
re no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the `gtm container id` setting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-gr5h-hm62-jr3j - https://github.com/discourse/discourse/commit/0976c8fad6970b6182e7837bf87de07709407f25
CVE ID: CVE-2023-37468 State: PUBLISHED Published: 2023-07-13T20:18:33.669Z Last Updated: 2024-10-22T15:00:30.416Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: thm-mni-ii Products: feedbacksystem Problem Types: CWE-312 Description: Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2. Additional An
s using only local login or the cas login are not affected. This issue has been patched in version 1.19.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-g28r-8wg3-7349 - https://github.com/thm-mni-ii/feedbacksystem/commit/8d896125263e1efb1b70990987c7704426325bcf - https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.9.2
CVE ID: CVE-2023-37469 State: PUBLISHED Published: 2023-08-24T22:12:10.234Z Last Updated: 2024-10-02T18:26:44.156Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IceWhaleTech Products: CasaOS Problem Types: CWE-77 Description: CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-119_CasaOS/ - https://github.com/IceW
DP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-119_CasaOS/ - https://github.com/IceWhaleTech/CasaOS/commit/af440eac5563644854ff33f72041e52d3fd1f47c - https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/route/v1/samba.go#L121 - https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/service/connections.go#L58 - https://github.com/IceWhaleTech/CasaOS/releases/tag/v0.4.4
CVE ID: CVE-2023-37470 State: PUBLISHED Published: 2023-08-04T15:12:43.188Z Last Updated: 2024-10-17T14:54:36.299Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: metabase Products: metabase Problem Types: CWE-94 Description: Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core issue is that one of the supported data warehouses (an embedded in-memory database H2), exposes a number of ways for a connection string to include code that is then e
ses (an embedded in-memory database H2), exposes a number of ways for a connection string to include code that is then executed by the process running the embedded database. Because Metabase allows users to connect to databases, this means that a user supplied string can be used to inject executable code. Metabase allows users to validate their connection string before adding a database (including on setup), and this validation API was the primary vector used as it can be called without validation. Versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4 fix this issue by removing the ability of users to add H2 databases entirely. As a workaround, it is pos
3, and 1.46.6.4 fix this issue by removing the ability of users to add H2 databases entirely. As a workaround, it is possible to block these vulnerabilities at the network level by blocking the endpoints `POST /api/database`, `PUT /api/database/:id`, and `POST /api/setup/validateuntil`. Those who use H2 as a file-based database should migrate to SQLite. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-p7w3-9m58-rq83
CVE ID: CVE-2023-37471 State: PUBLISHED Published: 2023-07-20T16:53:23.977Z Last Updated: 2024-10-24T14:53:39.210Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: OpenIdentityPlatform Products: OpenAM Problem Types: CWE-287 Description: Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially craf
ss. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-4mh8-9wq6-rjxg - https://github.com/OpenIdentityPlatform/OpenAM/pull/624 - https://github.com/OpenIdentityPlatform/OpenAM/commit/7c18543d126e8a567b83bb4535631825aaa9d742
CVE ID: CVE-2023-37472 State: PUBLISHED Published: 2023-07-14T20:17:07.296Z Last Updated: 2024-10-30T18:32:13.471Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: KnowageLabs Products: Knowage-Server Problem Types: CWE-89 Description: Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanitization. An attacker can create specially crafted HQL queries that will break subsequent SQL queries generated by the Hibernate engine. The endpoint `_/knowage/restful-services/2.0/documents/listDocument_` calls the `_countBIObjects_` method of the `_BIObjectDAOHibImpl_` object with the use
vices/2.0/documents/listDocument_` calls the `_countBIObjects_` method of the `_BIObjectDAOHibImpl_` object with the user supplied `_label_` parameter without prior sanitization. This can lead to SQL injection in the backing database. Other injections have been identified in the application as well. An authenticated attacker with low privileges could leverage this vulnerability in order to retrieve sensitive information from the database, such as account credentials or business information. This issue has been addressed in version 8.1.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-2j3f-f696-7rgj
CVE ID: CVE-2023-37473 State: PUBLISHED Published: 2023-07-14T20:00:16.909Z Last Updated: 2024-10-18T17:42:36.436Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: zenstruck Products: collection Problem Types: CWE-74 Description: zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input
included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zenstruck/collection/security/advisories/GHSA-7xr2-8ff7-6fjq - https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c - https://github.com/zenstruck/collection/releases/tag/v0.2.1
CVE ID: CVE-2023-37474 State: PUBLISHED Published: 2023-07-14T19:55:22.779Z Last Updated: 2025-02-13T17:01:27.796Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: 9001 Products: copyparty Problem Types: CWE-22 Description: Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds
commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg - https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff - http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html
CVE ID: CVE-2023-37475 State: PUBLISHED Published: 2023-07-17T16:36:23.546Z Last Updated: 2024-10-18T17:38:36.924Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: hamba Products: avro Problem Types: CWE-400 Description: Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to `Unmarshal()` to determine the size when creating a new slice an
use of the issue is that avro uses part of the input to `Unmarshal()` to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash. This issue has been addressed in commit `b4a402f4` which has been included in release version `2.13.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hamba/avro/security/advisories/GHSA-9x44-9pgq-cf45 - https://github.com/hamba/avro/commit/b4a402f41cf44b6094b5131286830ba9bb1eb290
CVE ID: CVE-2023-37476 State: PUBLISHED Published: 2023-07-17T21:02:46.588Z Last Updated: 2025-06-10T15:30:33.285Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: OpenRefine Products: OpenRefine Problem Types: CWE-22 Description: OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import Op
luding 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-m88m-crr9-jvqq - https://github.com/OpenRefine/OpenRefine/commit/e9c1e65d58b47aec8cd676bd5c07d97b002f205e - https://github.com/OpenRefine/OpenRefine/releases/tag/3.7.4 - https://www.sonarsource.com/blog/openrefine-zip-slip
CVE ID: CVE-2023-37477 State: PUBLISHED Published: 2023-07-18T18:25:53.691Z Last Updated: 2024-10-18T17:22:22.643Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-78 Description: 1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. 1Panel firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the defa
l firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. This issue has been addressed in commit `e17b80cff49` which is included in release version `1.4.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-p9xf-74xh-mhw5 - https://github.com/1Panel-dev/1Panel/comm
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-p9xf-74xh-mhw5 - https://github.com/1Panel-dev/1Panel/commit/e17b80cff4975ee343568ff526b62319f499005d
CVE ID: CVE-2023-37478 State: PUBLISHED Published: 2023-08-01T11:43:04.080Z Last Updated: 2024-10-10T16:00:56.935Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pnpm Products: pnpm Problem Types: CWE-284 Description: pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8. Addition
mised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pnpm/pnpm/security/advisories/GHSA-5r98-f33j-g8h7 - https://github.com/pnpm/pnpm/releases/tag/v7.33.4 - https://github.com/pnpm/pnpm/releases/tag/v8.6.8
CVE ID: CVE-2023-37479 State: PUBLISHED Published: 2023-07-17T22:13:39.400Z Last Updated: 2024-10-10T18:58:56.240Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: openenclave Products: openenclave Problem Types: CWE-665 Description: Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open Enclave SDK does not properly sanitize the `MXCSR` register on enclave entry. This makes applications vulnerable to MXCSR Configuration Dependent Timing (MCDT) attacks, where incorrect `MXCSR` v
ry. This makes applications vulnerable to MXCSR Configuration Dependent Timing (MCDT) attacks, where incorrect `MXCSR` values can impact instruction retirement by at most one cycle, depending on the (secret) data operand value. Please find more details in the guidance from Intel in the references. Second, Open Enclave SDK does not sanitize x86's alignment check flag `RFLAGS.AC` on enclave entry. This opens up the possibility for a side-channel attacker to be notified for every unaligned memory access performed by the enclave. The issue has been addressed in version 0.19.3 and the current master branch. Users will need to recompile their applications against the patched libraries to be protec
nd the current master branch. Users will need to recompile their applications against the patched libraries to be protected from this vulnerability. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openenclave/openenclave/security/advisories/GHSA-5gfr-m6mx-p5w4 - https://github.com/openenclave/openenclave/commit/ca54623333875b9beaad92c999a92b015c44b079 - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/mxcsr-configuration-dependent-timing.html