Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
server/respond.js`. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed in versions prior to 1.15.2 by simply specifying an upper-cased `Content-Type` header value. The browser will not send uppercase characters, but this check does not block all expected CORS requests. If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts. This may lead to all POST operations requiring authentication being allowed in the following cases: If the target
ounts. This may lead to all POST operations requiring authentication being allowed in the following cases: If the target site sets `SameSite=None` on its auth cookie and the user visits a malicious site in a Chromium-based browser; if the target site doesn't set the `SameSite` attribute explicitly and the user visits a malicious site with Firefox/Safari with tracking protections turned off; and/or if the user is visiting a malicious site with a very outdated browser. SvelteKit 1.15.2 contains a patch for this issue. It is also recommended to explicitly set `SameSite` to a value other than `None` on authentication cookies especially if the upgrade cannot be done in a timely manner. Additional
alue other than `None` on authentication cookies especially if the upgrade cannot be done in a timely manner. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sveltejs/kit/security/advisories/GHSA-gv7g-x59x-wf8f - https://github.com/sveltejs/kit/commit/ba436c6685e751d968a960fbda65f24cf7a82e9f
CVE ID: CVE-2023-29009 State: PUBLISHED Published: 2023-10-27T19:30:18.390Z Last Updated: 2024-09-09T14:59:18.101Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-8vqx-prq4-rqrq - https://basercms.net/security/JVN_45547161 - https://github.com/ba
ct/basercms/security/advisories/GHSA-8vqx-prq4-rqrq - https://basercms.net/security/JVN_45547161 - https://github.com/baserproject/basercms/releases/tag/basercms-4.8.0
CVE ID: CVE-2023-29010 State: PUBLISHED Published: 2023-04-06T16:02:18.684Z Last Updated: 2025-02-10T20:19:00.243Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Budibase Products: budibase Problem Types: CWE-918 Description: Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action. Self-host users who run Budibase on the public internet and are using a cloud provider that allows HTTP access to metadata information shoul
run Budibase on the public internet and are using a cloud provider that allows HTTP access to metadata information should ensure that when they deploy Budibase live, their internal metadata endpoint is not exposed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Budibase/budibase/security/advisories/GHSA-9xg2-9mcv-985p - https://github.com/Budibase/budibase/commits/develop?after=93d6939466aec192043d8ac842e754f65fdf2e8a+594&branch=develop&qualified_name=refs%2Fheads%2Fdevelop - https://github.com/Budibase/budibase/releases/tag/v2.4.3
CVE ID: CVE-2023-29011 State: PUBLISHED Published: 2023-04-25T20:40:30.247Z Last Updated: 2025-02-03T18:07:25.939Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: git-for-windows Products: git Problem Types: CWE-427 Description: Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SSH servers via proxies when certain ports are blocked for outgoing connections. The location of `connect.exe`'s config file is hard-coded as `/etc/connectrc` which will typically be interpreted as `C:\etc\connectrc`. Since `C:\etc` can be created by any authenticated user, this ma
ch will typically be interpreted as `C:\etc\connectrc`. Since `C:\etc` can be created by any authenticated user, this makes `connect.exe` susceptible to malicious files being placed there by other users on the same multi-user machine. The problem has been patched in Git for Windows v2.40.1. As a workaround, create the folder `etc` on all drives where Git commands are run, and remove read/write access from those folders. Alternatively, watch out for malicious `<drive>:\etc\connectrc` files on multi-user machines. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/git-for-windows/git/security/advisories/GHSA-g4fv-xjqw-q7jm - https://git
Vulnrichment: References: - https://github.com/git-for-windows/git/security/advisories/GHSA-g4fv-xjqw-q7jm - https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1
CVE ID: CVE-2023-29012 State: PUBLISHED Published: 2023-04-25T20:44:05.329Z Last Updated: 2025-02-03T18:06:37.041Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: git-for-windows Products: git Problem Types: CWE-427 Description: Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` would be executed silently upon running Git CMD. The problem has been patched in Git for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted dire
t for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/git-for-windows/git/security/advisories/GHSA-gq5x-v87v-8f7g - https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1
CVE ID: CVE-2023-29013 State: PUBLISHED Published: 2023-04-14T18:15:12.622Z Last Updated: 2025-02-13T16:48:58.656Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: traefik Products: traefik Problem Types: CWE-400 Description: Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2. Additional Analyst Not
ited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 - https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 - https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 - https://github.com/traefik/traefik/releases/tag/v2.9.10 - https://security.netapp.com/advisory/ntap-20230517-0008/
CVE ID: CVE-2023-29014 State: PUBLISHED Published: 2023-04-06T19:03:19.967Z Last Updated: 2025-02-10T16:12:23.454Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: intranda Products: goobi-viewer-core Problem Types: CWE-79 Description: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. Th
afted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7v7g-9vx6-vcg2 - https://github.com/intranda/goobi-viewer-core/commit/c29efe60e745a94d03debc17681c4950f3917455
CVE ID: CVE-2023-29015 State: PUBLISHED Published: 2023-04-06T19:03:23.713Z Last Updated: 2025-02-10T16:11:59.823Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: intranda Products: goobi-viewer-core Problem Types: CWE-79 Description: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in versi
on of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h - https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256
CVE ID: CVE-2023-29016 State: PUBLISHED Published: 2023-04-06T19:03:26.948Z Last Updated: 2025-02-10T16:11:32.488Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: intranda Products: goobi-viewer-core Problem Types: CWE-79 Description: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter malicious scripts into their profile's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages. The vulner
e's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages. The vulnerability has been fixed in version 23.03. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2r9r-8fcg-m38g - https://github.com/intranda/goobi-viewer-core/commit/8eadb32b3fdcb775678b74d95bc3df018a5d5238
CVE ID: CVE-2023-29017 State: PUBLISHED Published: 2023-04-06T19:18:34.243Z Last Updated: 2025-02-10T16:10:57.765Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: patriksimek Products: vm2 Problem Types: CWE-913 Description: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known w
e host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv - https://github.com/patriksimek/vm2/issues/515 - https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50 - https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d
CVE ID: CVE-2023-29018 State: PUBLISHED Published: 2023-04-14T18:47:03.747Z Last Updated: 2025-02-06T18:42:47.890Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: open-feature Products: open-feature-operator Problem Types: CWE-269 Description: The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controller-manager` to escalate the privileges of any SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive da
SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets. Version 0.2.32 mitigates this issue by restricting the resources the `open-feature-operator-controller-manager` can modify. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open-feature/open-feature-operator/security/advisories/GHSA-cwf6-xj49-wp83 - https://github.com/open-feature/open-feature-operator/releases/tag/v0.2.32
CVE ID: CVE-2023-29019 State: PUBLISHED Published: 2023-04-21T22:28:55.045Z Last Updated: 2025-02-04T19:38:59.862Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: fastify Products: fastify-passport Problem Types: CWE-384 Description: @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The l
ork and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrad
the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fastify/fastify-passport/security/advisories/GHSA-4m3m-ppvx-xgw9 - https://github.com/fastify/fastify-passport/commit/43c82c321db58ea3e375dd475de60befbfcf2a11 - https://owasp.org/www-community/attacks/Session_fixation
CVE ID: CVE-2023-29020 State: PUBLISHED Published: 2023-04-21T22:31:56.768Z Last Updated: 2025-02-04T19:38:09.698Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: fastify Products: fastify-passport Problem Types: CWE-384, CWE-352 Description: @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be bypassed by network and same-site attackers. `fastify/csrf-protection` implements the synchronizer token pattern (using plugins `@fastify/session` and `@fastify/secu
`fastify/csrf-protection` implements the synchronizer token pattern (using plugins `@fastify/session` and `@fastify/secure-session`) by storing a random value used for CSRF token generation in the `_csrf` attribute of a user's session. The `@fastify/passport` library does not clear the session object upon authentication, preserving the `_csrf` attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and same-site attackers can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. As a sol
sion in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. As a solution, newer versions of `@fastify/passport` include the configuration options: `clearSessionOnLogin (default: true)` and `clearSessionIgnoreFields (default: ['passport', 'session'])` to clear all the session attributes by default, preserving those explicitly defined in `clearSessionIgnoreFields`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fastify/fastify-passport/security/advisories/GHSA-2ccf-ffrj-m4qw - https://github.com/fastify/fastify-passport/commit/07c90feab9cba0dd4779e47cfb0717a7e2f01d3d - https://che
cf-ffrj-m4qw - https://github.com/fastify/fastify-passport/commit/07c90feab9cba0dd4779e47cfb0717a7e2f01d3d - https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern - https://owasp.org/www-community/attacks/csrf
CVE ID: CVE-2023-29022 State: PUBLISHED Published: 2023-05-11T17:51:33.822Z Last Updated: 2025-01-24T16:15:52.659Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
o the availability of the web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE ID: CVE-2023-29023 State: PUBLISHED Published: 2023-05-11T17:41:54.222Z Last Updated: 2024-08-02T14:00:14.750Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://rockwellautomation.custhelp.com/ap
lnerability. Additional Analyst Notes: - CVE Program Container: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE ID: CVE-2023-29024 State: PUBLISHED Published: 2023-05-11T17:42:45.941Z Last Updated: 2024-08-02T14:00:14.659Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product A cross site scripting vulnerability was discovered that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability. Additional Analyst Notes: - CVE Program Container:
tack, is required for successful exploitation of this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE ID: CVE-2023-29025 State: PUBLISHED Published: 2023-05-11T17:45:59.896Z Last Updated: 2024-08-02T14:00:14.643Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Additional Analyst Notes: - CVE Program Container: References: - https://rockwellaut
o the availability of the web page. Additional Analyst Notes: - CVE Program Container: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438
CVE ID: CVE-2023-29026 State: PUBLISHED Published: 2023-05-11T17:47:11.276Z Last Updated: 2025-01-24T16:32:47.478Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-20 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
CVE ID: CVE-2023-29027 State: PUBLISHED Published: 2023-05-11T17:47:55.876Z Last Updated: 2025-01-24T16:29:53.221Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
CVE ID: CVE-2023-29028 State: PUBLISHED Published: 2023-05-11T17:50:48.406Z Last Updated: 2025-01-24T16:28:39.146Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
CVE ID: CVE-2023-29029 State: PUBLISHED Published: 2023-05-11T17:51:13.275Z Last Updated: 2025-01-24T16:27:29.116Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Rockwell Automation Products: ArmorStart ST Problem Types: CWE-79 Description: A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc