Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none The vulnerability in the affected downstream component “Form Framework Module”
ite` configuration is set to lax or none The vulnerability in the affected downstream component “Form Framework Module” allows attackers to manipulate or delete persisted form definitions. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-ww7h-g2qf-7xv6 - https://typo3.org/security/advisory/typo3-core-sa-2025-007
CVE ID: CVE-2024-55923 State: PUBLISHED Published: 2025-01-14T19:20:11.061Z Last Updated: 2025-01-15T15:01:28.523Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-352, CWE-749 Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of th
rrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Indexed Search Module”
ite` configuration is set to lax or none. The vulnerability in the affected downstream component “Indexed Search Module” allows attackers to delete items of the component. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-7r5q-4qgx-v545 - https://typo3.org/security/advisory/typo3-core-sa-2025-008
CVE ID: CVE-2024-55924 State: PUBLISHED Published: 2025-01-14T19:16:46.693Z Last Updated: 2025-01-15T15:02:04.879Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: TYPO3 Products: typo3 Problem Types: CWE-352, CWE-749 Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this v
tly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Scheduler Module” allows a
configuration is set to lax or none. The vulnerability in the affected downstream component “Scheduler Module” allows attackers to trigger pre-defined command classes - which can lead to unauthorized import or export of data in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS which fixes the problem described. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-7835-fcv3-g256 - https://typo3.org/security/advisory/typo3-core-sa-2025-009
CVE ID: CVE-2024-55925 State: PUBLISHED Published: 2025-01-23T17:03:33.187Z Last Updated: 2025-09-17T16:49:42.753Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Xerox Products: Xerox Workplace Suite Problem Types: CWE-290 Description: In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
idation, potentially exposing sensitive API endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE ID: CVE-2024-55926 State: PUBLISHED Published: 2025-01-23T17:12:21.371Z Last Updated: 2025-02-24T17:11:02.567Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Xerox Products: Xerox Workplace Suite Problem Types: CWE-434, CWE-22 Description: A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-W
- https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE ID: CVE-2024-55927 State: PUBLISHED Published: 2025-01-23T17:20:29.974Z Last Updated: 2025-02-24T17:12:10.831Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Xerox Products: Xerox Workplace Suite Problem Types: CWE-798 Description: A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE ID: CVE-2024-55928 State: PUBLISHED Published: 2025-01-23T17:25:46.915Z Last Updated: 2025-02-24T17:16:19.462Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Xerox Products: Xerox Workplace Suite Problem Types: CWE-312 Description: Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE ID: CVE-2024-55929 State: PUBLISHED Published: 2025-01-23T17:30:34.224Z Last Updated: 2025-02-24T17:17:09.394Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Xerox Products: Xerox Workplace Suite Problem Types: CWE-345 Description: A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE ID: CVE-2024-55930 State: PUBLISHED Published: 2025-01-23T17:36:01.763Z Last Updated: 2025-02-24T17:18:39.252Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Xerox Products: Xerox Workplace Suite Problem Types: CWE-276 Description: Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE ID: CVE-2024-55931 State: PUBLISHED Published: 2025-01-27T11:28:45.510Z Last Updated: 2025-02-24T17:20:04.431Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Xerox Products: Xerox Workplace Suite Problem Types: CWE-922 Description: Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified through an update to the security bulletin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/0
Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE ID: CVE-2024-55945 State: PUBLISHED Published: 2025-01-14T19:14:33.725Z Last Updated: 2025-01-14T19:46:24.390Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: TYPO3 Products: typo3 Problem Types: CWE-352, CWE-749 Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of th
rrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to `lax` or `none`. The vulnerability in the affected downstream component “DB Check Module” a
ite` configuration is set to `lax` or `none`. The vulnerability in the affected downstream component “DB Check Module” allows attackers to manipulate data through unauthorized actions. Users are advised to update to TYPO3 versions 11.5.42 ELTS which fixes the problem described. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-8mv3-37rc-pvxj - https://typo3.org/security/advisory/typo3-core-sa-2025-010
CVE ID: CVE-2024-55946 State: PUBLISHED Published: 2024-12-13T20:53:35.708Z Last Updated: 2024-12-16T14:24:32.338Z Vendors: Quetrobits Products: Playloom-Engine Problem Types: CWE-200 Description: Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have entered into the software. This poses a risk to user privacy. The maintainers of Playloom Engine have temporarily disabled the collaboration feature until a fix can be implemented. When Engine Beta v0.0.2 is r
Engine have temporarily disabled the collaboration feature until a fix can be implemented. When Engine Beta v0.0.2 is released, it is expected to contain a patch addressing this issue. Users should refrain from using the collaboration feature in the meantime. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Quetrobits/Playloom-Engine/security/advisories/GHSA-75gm-rc5q-6jwv
CVE ID: CVE-2024-55947 State: PUBLISHED Published: 2024-12-23T15:26:47.507Z Last Updated: 2024-12-24T15:59:02.793Z Vendors: gogs Products: gogs Problem Types: CWE-22 Description: Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gogs/gogs/security/advisories/GHSA-qf5v-rp47-55gg - https://github.com/gogs/gogs/issues/7582 - https://github.com/gogs/gogs/pull/7859 - https://github.com/gogs/gogs/commit/9a9388ace25bd646f5098cb9193d983332c34e41
CVE ID: CVE-2024-55948 State: PUBLISHED Published: 2025-02-04T21:01:59.746Z Last Updated: 2025-02-04T21:23:21.326Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: discourse Products: discourse Problem Types: CWE-346 Description: Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache (for example, the cache may have a response with missing preloaded data). This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable anonymous cache by
the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable anonymous cache by setting the `DISCOURSE_DISABLE_ANON_CACHE` environment variable to a non-empty value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-2352-252q-qc82
CVE ID: CVE-2024-55949 State: PUBLISHED Published: 2024-12-16T20:02:00.856Z Last Updated: 2024-12-16T20:18:46.452Z Vendors: minio Products: minio Problem Types: CWE-269 Description: MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
unds possible, all users are advised to upgrade immediately. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg - https://github.com/minio/minio/pull/20756 - https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f - https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427
CVE ID: CVE-2024-55950 State: PUBLISHED Published: 2024-12-26T21:52:44.619Z Last Updated: 2024-12-27T16:17:59.385Z Vendors: Eugeny Products: tabby Problem Types: CWE-276 Description: Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains overly permissive entitlements that are unnecessary for its core functionality and plugin system, creating potential security vulnerabilities. The application currently holds powerful permissions including camera, microphone access, and the ability to access personal folders (Downloads, Documents, etc.) through Apple Events, while also maintaining dangerous entitlements that enable code inject
(Downloads, Documents, etc.) through Apple Events, while also maintaining dangerous entitlements that enable code injection. The concerning entitlements are com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation. Since Tabby's plugins and themes are NodeJS-based without native libraries or frameworks, and no environment variables are used in the codebase, it is recommended to review and remove at least one of the entitlements (com.apple.security.cs.disable-library-validation or com.apple.security.cs.allow-dyld-environment-variables) to prevent DYLD_INSERT_LIBRARIES injection while maintaining full application functionality. This vulnerabil
-variables) to prevent DYLD_INSERT_LIBRARIES injection while maintaining full application functionality. This vulnerability is fixed in 1.0.216. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Eugeny/tabby/security/advisories/GHSA-jx33-9jc7-24gc - https://github.com/Eugeny/tabby/commit/e1e6e1cdab0310a881e36afd7c2744e5f905518b
CVE ID: CVE-2024-55951 State: PUBLISHED Published: 2024-12-16T20:03:54.861Z Last Updated: 2024-12-17T15:17:36.574Z Vendors: metabase Products: metabase Problem Types: CWE-200 Description: Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There are no workarounds for this issue aside from upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-rhjf-q2qw-rvx3 - https://downloads
richment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-rhjf-q2qw-rvx3 - https://downloads.metabase.com/v0.52.2.5/metabase.jar - https://hub.docker.com/r/metabase/metabase/tags
CVE ID: CVE-2024-55952 State: PUBLISHED Published: 2024-12-18T18:49:24.214Z Last Updated: 2024-12-18T19:16:19.747Z Vendors: dataease Products: dataease Problem Types: CWE-20 Description: DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. Constructing the host as ip:5432/test/?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://ip:5432/1.xml&a= can trigger the ClassPathXmlApplicationContext construction method. The vulnerability has been fixed in v1.18.27. Users are advised to upg
assPathXmlApplicationContext construction method. The vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-w8qm-xw38-93qw - https://github.com/dataease/dataease/commit/0db4872a52eccf6e83dd9359aa05db52dd580ec1
CVE ID: CVE-2024-55953 State: PUBLISHED Published: 2024-12-18T18:49:21.632Z Last Updated: 2024-12-18T19:16:27.090Z Vendors: dataease Products: dataease Problem Types: CWE-89 Description: DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-mrf3-9q84-rcmf - https
ISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-mrf3-9q84-rcmf - https://github.com/dataease/dataease/commit/0db4872a52eccf6e83dd9359aa05db52dd580ec1
CVE ID: CVE-2024-55954 State: PUBLISHED Published: 2025-01-16T19:30:39.218Z Last Updated: 2025-02-12T20:31:21.093Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: openobserve Products: openobserve Problem Types: CWE-269, CWE-272, CWE-284, CWE-285, CWE-287 Description: OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the highest-privileged account. Due to insufficient role checks, the `remove_user_from_org` function does
ser to remove the highest-privileged account. Due to insufficient role checks, the `remove_user_from_org` function does not prevent an "Admin" user from removing a "Root" user. As a result, an attacker with an "Admin" role can remove critical "Root" users, potentially gaining effective full control by eliminating the highest-privileged accounts. The `DELETE /api/{org_id}/users/{email_id}` endpoint is affected. This issue has been addressed in release version `0.14.1` and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openobserve/openobserve/security/advisories/GHSA-m8
yst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openobserve/openobserve/security/advisories/GHSA-m8gj-6r85-3r6m - https://github.com/gaby/openobserve/blob/main/src/service/users.rs#L631
CVE ID: CVE-2024-55955 State: PUBLISHED Published: 2024-12-31T16:19:35.471Z Last Updated: 2025-03-05T04:55:27.005Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Deep Security Problem Types: CWE-427 Description: An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment:
ged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0018571
CVE ID: CVE-2024-55956 State: PUBLISHED Published: 2024-12-13T00:00:00.000Z Last Updated: 2025-10-21T22:55:34.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending