Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25115 State: PUBLISHED Published: 2024-04-09T17:31:48.469Z Last Updated: 2024-08-01T23:36:21.630Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: RedisBloom Products: RedisBloom Problem Types: CWE-122, CWE-120 Description: RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted `CF.LOADCHUNK` commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://githu
.4.7 and 2.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-w583-p2wh-4vj5 - https://github.com/RedisBloom/RedisBloom/commit/2f3b38394515fc6c9b130679bcd2435a796a49ad
CVE ID: CVE-2024-25116 State: PUBLISHED Published: 2024-04-09T17:35:08.800Z Last Updated: 2024-08-01T23:36:21.715Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: RedisBloom Products: RedisBloom Problem Types: CWE-20 Description: RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, authenticated users can use the `CF.RESERVE` command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in RedisBloom 2.4.7 and 2.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RedisBloom/Redi
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-wrwq-cfrx-pmg4 - https://github.com/RedisBloom/RedisBloom/commit/61d980a429050637f1af9fe919a880800a824f2a
CVE ID: CVE-2024-25117 State: PUBLISHED Published: 2024-02-21T16:25:17.970Z Last Updated: 2024-08-28T17:57:19.358Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: dompdf Products: php-svg-lib Problem Types: CWE-73, CWE-502 Description: php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-
ictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib. The `Style::fromAttributes(`), or the `Style::parseCssStyle()` should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the `Style::fromStyleSheets` might be reused. Libraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even remote code execution, if they do not double check the value of the `fontName` that is passed by php-svg-lib. Version 0.5.2 contains a fix for this issue. Additional Analyst N
value of the `fontName` that is passed by php-svg-lib. Version 0.5.2 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273 - https://github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa - https://github.com/dompdf/php-svg-lib/commit/8ffcc41bbde39f09f94b9760768086f12bbdce42
CVE ID: CVE-2024-25118 State: PUBLISHED Published: 2024-02-13T22:19:22.690Z Last Updated: 2024-08-01T23:36:21.691Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-200 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force techniques. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.
d user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-38r2-5695-334w - https://typo3.org/security/advisory/typo3-core-sa-2024-003
CVE ID: CVE-2024-25119 State: PUBLISHED Published: 2024-02-13T22:16:37.103Z Last Updated: 2024-08-01T23:36:21.621Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-200 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user ac
e authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-h47m-3f78-qp9g - https://typo3.org/security/advisory/typo3-core-sa-2024-004
CVE ID: CVE-2024-25120 State: PUBLISHED Published: 2024-02-13T22:15:13.294Z Last Updated: 2025-04-24T15:38:47.572Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-200, CWE-284 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versi
ovided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-wf85-8hx9-gj7c - https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Functions/Typolink.html#resource-references - https://typo3.org/security/advisory/typo3-core-sa-2024-005
CVE ID: CVE-2024-25121 State: PUBLISHED Published: 2024-02-13T22:14:40.926Z Last Updated: 2025-05-09T18:30:22.296Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-200, CWE-284 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside
and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which fix the problem described. When persisting entities of the File Abstraction Layer directly via DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata` entities are not permitted to reference files in the fallback storage anymore. When importing data from s
file_metadata` entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using `$dataHandler->isImporting = true;`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-rj3x-wvc6-5j66 - https://typo3.org/security/advisory/typo3-core-sa-2024-006
CVE ID: CVE-2024-25122 State: PUBLISHED Published: 2024-02-13T19:05:27.162Z Last Updated: 2024-08-01T23:36:21.771Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: mhenrixon Products: sidekiq-unique-jobs Problem Types: CWE-79 Description: sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially crafted GET request parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI, allow a super-user attacker, or an unwitting, but authorized, victim, who has received a disguised / crafted link, to successfully execute malicious code, which could potentially st
victim, who has received a disguised / crafted link, to successfully execute malicious code, which could potentially steal cookies, session data, or local storage data from the app the sidekiq-unique-jobs web UI is mounted in. 1. `/changelogs`, 2. `/locks` or 3. `/expiring_locks`. This issue has been addressed in versions 7.1.33 and 8.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38 - https://github.com/mhenrixon/sidekiq-unique-jobs/commit/ec3afd920c1b55843c72f748a87baac7f8b
sories/GHSA-cmh9-rx85-xj38 - https://github.com/mhenrixon/sidekiq-unique-jobs/commit/ec3afd920c1b55843c72f748a87baac7f8be82ed
CVE ID: CVE-2024-25123 State: PUBLISHED Published: 2024-02-15T21:33:01.922Z Last Updated: 2024-08-28T18:04:21.158Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Open-MSS Products: MSS Problem Types: CWE-22 Description: MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The `filename` variable is joined with other variables to form a file path in `_file`. However, `filename` is a route parameter that can capture path type v
th other variables to form a file path in `_file`. However, `filename` is a route parameter that can capture path type values i.e. values including slashes (\). So it is possible for an attacker to manipulate the file being read by assigning a value containing ../ to `filename` and so the attacker may be able to gain access to other files on the host filesystem. This issue has been addressed in MSS version 8.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Open-MSS/MSS/security/advisories/GHSA-pf2h-qjcr-qvq2 - https://github.com/Open-MSS/MSS/co
ferences: - https://github.com/Open-MSS/MSS/security/advisories/GHSA-pf2h-qjcr-qvq2 - https://github.com/Open-MSS/MSS/commit/f23033729ee930b97f8bdbd07df0174311c9b658
CVE ID: CVE-2024-25124 State: PUBLISHED Published: 2024-02-21T21:01:44.672Z Last Updated: 2024-08-26T14:39:19.825Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: gofiber Products: fiber Problem Types: CWE-346, CWE-942 Description: Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard (`*`) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impac
ving the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impact of this misconfiguration is high as it can lead to unauthorized access to sensitive user data and expose the system to various types of attacks listed in the PortSwigger article linked in the references. Version 2.52.1 contains a patch for this issue. As a workaround, users may manually validate the CORS configurations in their implementation to ensure that they do not allow a wildcard origin when credentials are enabled. The browser fetch api, as well as browsers and utilities that enforce CORS policies, are not affected by this. Additional Analyst Notes: - CVE Program C
s browsers and utilities that enforce CORS policies, are not affected by this. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg - https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23 - https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials - https://fetch.spec.whatwg.org/#cors-protocol-and-credentials - https://github.com/gofiber/fiber/releases/tag/v2.52.1 - https://saturncloud.io/blog/cors-cannot-use-wildcard-in-accessc
https://github.com/gofiber/fiber/releases/tag/v2.52.1 - https://saturncloud.io/blog/cors-cannot-use-wildcard-in-accesscontrolalloworigin-when-credentials-flag-is-true - http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
CVE ID: CVE-2024-25125 State: PUBLISHED Published: 2024-02-14T01:12:05.181Z Last Updated: 2024-08-14T18:51:43.903Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: treasure-data Products: digdag Problem Types: CWE-22 Description: Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload automation system is susceptible to a path traversal vulnerability if it's configured to store log files locally. This issue may lead to information disclosure and has been addressed in release version 0.10.5.1. Users are advised to upgrade. There are no known workarounds for thi
and has been addressed in release version 0.10.5.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/treasure-data/digdag/security/advisories/GHSA-5mp4-32rr-v3x5 - https://github.com/treasure-data/digdag/commit/eae89b0daf6c62f12309d8c7194454dfb18cc5c3
CVE ID: CVE-2024-25126 State: PUBLISHED Published: 2024-02-28T23:28:07.073Z Last Updated: 2025-02-13T17:40:47.635Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: rack Products: rack Problem Types: CWE-1333 Description: Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c
rogram Container: - CISA ADP Vulnrichment: References: - https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx - https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462 - https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49 - https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941 - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml - https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html - https://security.netapp.com/advisory/ntap-20240510-0005/
CVE ID: CVE-2024-25128 State: PUBLISHED Published: 2024-02-28T15:30:27.705Z Last Updated: 2024-08-26T19:54:53.575Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: dpgaspar Products: Flask-AppBuilder Problem Types: CWE-287 Description: Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerabilit
privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-j2pw-vp55-fqqj - https://github.com/dpgaspar/Flask-AppBuilder/commit/6336456d83f8f111c842b2b53d1e89627f2502c8
CVE ID: CVE-2024-25129 State: PUBLISHED Published: 2024-02-22T18:23:33.228Z Last Updated: 2024-08-01T23:36:21.644Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: github Products: codeql-cli-binaries Problem Types: CWE-611 Description: The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable version of the CLI is used to process either a maliciously modified CodeQL database, or a specially prepared set of QL query sources, the CLI can be made to make an outgoing HTTP request to an UR
database, or a specially prepared set of QL query sources, the CLI can be made to make an outgoing HTTP request to an URL that contains material read from a local file chosen by the attacker. This may result in a loss of privacy of exfiltration of secrets. Security researchers and QL authors who receive databases or QL source files from untrusted sources may be impacted. A single untrusted `.ql` or `.qll` file cannot be affected, but a zip archive or tarball containing QL sources may unpack auxiliary files that will trigger an attack when CodeQL sees them in the file system. Those using CodeQL for routine analysis of source trees with a preselected set of trusted queries are not affected. In
. Those using CodeQL for routine analysis of source trees with a preselected set of trusted queries are not affected. In particular, extracting XML files from a source tree into the CodeQL database does not make one vulnerable. The problem is fixed in release 2.16.3 of the CodeQL CLI. Other than upgrading, workarounds include not accepting CodeQL databases or queries from untrusted sources, or only processing such material on a machine without an Internet connection. Customers who use older releases of CodeQL for security scanning in an automated CI system and cannot upgrade for compliance reasons can continue using that version. That use case is safe. If such customers have a private query
e for compliance reasons can continue using that version. That use case is safe. If such customers have a private query pack and use the `codeql pack create` command to precompile them before using them in the CI system, they should be using the production CodeQL release to run `codeql pack create`. That command is safe as long as the QL source it precompiled is trusted. All other development of the query pack should use an upgraded CLI. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/github/codeql-cli-binaries/security/advisories/GHSA-gf8p-v3g3-3wph - https://github.com/github/codeql-cli-binaries/releases/tag/v2.16.3 - https://git
curity/advisories/GHSA-gf8p-v3g3-3wph - https://github.com/github/codeql-cli-binaries/releases/tag/v2.16.3 - https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-611/XXELocal.ql
CVE ID: CVE-2024-25130 State: PUBLISHED Published: 2024-02-22T18:29:10.138Z Last Updated: 2024-08-27T20:46:21.591Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-200 Description: Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is used might get access to restricted information. Tuleap Community Edition 15.5.99.76, Tuleap Enterprise Edition 15.5-4, and Tuleap Enterprise Editio
tricted information. Tuleap Community Edition 15.5.99.76, Tuleap Enterprise Edition 15.5-4, and Tuleap Enterprise Edition 15.4-7 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-mq7f-m6mj-hjj5 - https://github.com/Enalean/tuleap/commit/57978a32508f5c6d0365419b6eaeb368aee20667 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=57978a32508f5c6d0365419b6eaeb368aee20667 - https://tuleap.net/plugins/tracker/?aid=36803
CVE ID: CVE-2024-25131 State: PUBLISHED Published: 2024-12-19T14:18:05.194Z Last Updated: 2025-07-23T22:46:15.035Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-20 Description: A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate their privileges to a cluster administrator and pivot to the AWS environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.
rator and pivot to the AWS environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-25131 - https://bugzilla.redhat.com/show_bug.cgi?id=2258856 - https://github.com/openshift/must-gather-operator/pull/135 - https://github.com/openshift/must-gather-operator/pull/138