Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24899 State: PUBLISHED Published: 2025-02-03T21:01:31.624Z Last Updated: 2025-02-12T20:51:25.976Z Vendors: yogeshojha Products: rengine Problem Types: CWE-200 Description: reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as `username`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request
`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request to `/api/listVulnerability/`. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine/security/advisories/GHSA-r3fp-xr9f-wv38 - https://github.com/yogeshojha/rengine/commit/a658b8519f1a3347634b04733cf91ed933af1f99
CVE ID: CVE-2025-24900 State: PUBLISHED Published: 2025-02-11T15:36:16.868Z Last Updated: 2025-02-11T16:09:43.878Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: nexryai Products: concorde Problem Types: CWE-352 Description: Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, there is a vulnerability that allows MediaProxy authentication to be bypassed. In versions prior to 12.25Q1.1, the authentication cookie does not have the SameSite attribute. This allows an attacker to bypass MediaProxy authentication and load an
ion cookie does not have the SameSite attribute. This allows an attacker to bypass MediaProxy authentication and load any image without restrictions under certain circumstances. In versions prior to 12.24Q2.3, this cookie was also used to authenticate the job queue management page (bull-board), so bull-board authentication is also bypassed. This may enable attacks that have a significant impact on availability and integrity. The affected versions are too old to be covered by this advisory, but the maintainers of Concorde strongly recommend not using older versions. Version 12.25Q1.1 contains a patch. There is no effective workaround other than updating. Additional Analyst Notes: - CISA ADP V
12.25Q1.1 contains a patch. There is no effective workaround other than updating. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nexryai/concorde/security/advisories/GHSA-5hgq-9vw8-7v87 - https://github.com/nexryai/concorde/commit/2309b4a292828ddba4d57cf0e914bc433095871d - https://github.com/nexryai/concorde/commit/f3f54bde6a37ad310f83ae46de54a286c4b74059
CVE ID: CVE-2025-24901 State: PUBLISHED Published: 2025-02-03T21:43:48.149Z Last Updated: 2025-02-04T15:47:01.776Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
here are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jp48-94wm-3gmc
CVE ID: CVE-2025-24902 State: PUBLISHED Published: 2025-02-03T21:43:46.205Z Last Updated: 2025-08-22T20:41:44.527Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pg73-w9vx-8mgp - https://github.com/LabRedesCefetRJ/WeGIA/commit/f535e873a8f26fe413d21f22e3eacc8c79b2fa7f
CVE ID: CVE-2025-24903 State: PUBLISHED Published: 2025-02-13T15:20:28.251Z Last Updated: 2025-02-13T16:27:04.294Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: whisperfish Products: libsignal-service-rs Problem Types: CWE-345 Description: libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonating another device of the local user. The origin of sync messages is not checked. Patched libsignal-service can be found after commit 82d70f6720e762898f34ae76b0894b029
n of sync messages is not checked. Patched libsignal-service can be found after commit 82d70f6720e762898f34ae76b0894b0297d9b2f8. The `Metadata` struct contains an additional `was_encrypted` field, which breaks the API, but should be easily resolvable. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/whisperfish/libsignal-service-rs/security/advisories/GHSA-r58q-66g9-h6g8 - https://github.com/whisperfish/libsignal-service-rs/commit/82d70f6720e762898f34ae76b0894b0297d9b2f8
CVE ID: CVE-2025-24904 State: PUBLISHED Published: 2025-02-13T15:24:20.246Z Last Updated: 2025-02-13T16:25:36.777Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: whisperfish Products: libsignal-service-rs Problem Types: CWE-287, CWE-74 Description: libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and may have been able to bypass the end-to-end encryption and authentication. The vulnerability is fixed per 82d70f6720e76289
y have been able to bypass the end-to-end encryption and authentication. The vulnerability is fixed per 82d70f6720e762898f34ae76b0894b0297d9b2f8. The `Metadata` struct contains an additional `was_encrypted` field, which breaks the API, but should be easily resolvable. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/whisperfish/libsignal-service-rs/security/advisories/GHSA-hrrc-wpfw-5hj2 - https://github.com/whisperfish/libsignal-service-rs/commit/82d70f6720e762898f34ae76b0894b0297d9b2f8
CVE ID: CVE-2025-24905 State: PUBLISHED Published: 2025-02-03T21:43:44.755Z Last Updated: 2025-02-04T15:16:53.198Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
grade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qjc6-5qv6-fr8m
CVE ID: CVE-2025-24906 State: PUBLISHED Published: 2025-02-03T21:43:43.185Z Last Updated: 2025-02-04T15:18:56.091Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
e. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jpph-g9p7-9jrm
CVE ID: CVE-2025-24907 State: PUBLISHED Published: 2025-04-16T22:39:15.660Z Last Updated: 2025-04-17T13:55:34.359Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics Problem Types: CWE-35 Description: Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) Description Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize
tachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API. Impact This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/35781624069005--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Path-Traversal-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24907
CVE ID: CVE-2025-24908 State: PUBLISHED Published: 2025-04-16T22:27:03.652Z Last Updated: 2025-04-17T13:08:53.765Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics Problem Types: CWE-35 Description: Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) Description Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize
tachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service. Impact This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/35783399569421--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Path-Traversal-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24908
CVE ID: CVE-2025-24909 State: PUBLISHED Published: 2025-04-16T22:30:10.219Z Last Updated: 2025-04-17T13:55:58.693Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-79 Description: Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. Impact Once the malicious
9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. Impact Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/35782541484045--Resolved-Hitachi-Vantara-Pentaho-
nrichment: References: - https://support.pentaho.com/hc/en-us/articles/35782541484045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24909
CVE ID: CVE-2025-24910 State: PUBLISHED Published: 2025-04-16T22:32:46.270Z Last Updated: 2025-04-17T13:55:49.636Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-611 Description: Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), t
k into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) Description Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity Reference. Impact By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers tha
URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/35782683750541--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24910
CVE ID: CVE-2025-24911 State: PUBLISHED Published: 2025-04-16T22:35:10.582Z Last Updated: 2025-04-17T13:55:42.352Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-611 Description: Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), t
k into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) Description Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Data Access XMLParserFactoryProducer against out-of-band XML External Entity Reference. Impact By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the att
other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/35783689016589--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24911
CVE ID: CVE-2025-24912 State: PUBLISHED Published: 2025-03-12T04:43:54.870Z Last Updated: 2025-03-12T13:21:59.254Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Jouni Malinen Products: hostapd Problem Types: CWE-826 Description: hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://w1.fi/hostapd/ - https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea
ment: References: - https://w1.fi/hostapd/ - https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44 - https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109 - https://jvn.jp/en/jp/JVN19358384/
CVE ID: CVE-2025-24914 State: PUBLISHED Published: 2025-04-18T18:18:02.729Z Last Updated: 2025-04-22T03:55:21.798Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenable Products: Nessus Problem Types: CWE-276 Description: When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. - CVE-2025-24914 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2025-05
CVE ID: CVE-2025-24915 State: PUBLISHED Published: 2025-03-21T14:13:35.208Z Last Updated: 2025-03-22T03:55:49.242Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenable Products: Nessus Agent Problem Types: CWE-276 Description: When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2025-02
CVE ID: CVE-2025-24916 State: PUBLISHED Published: 2025-05-23T15:46:02.459Z Last Updated: 2025-05-28T03:56:01.067Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenable Products: Network Monitor Problem Types: CWE-284 Description: When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2025-10
CVE ID: CVE-2025-24917 State: PUBLISHED Published: 2025-05-23T15:59:20.064Z Last Updated: 2025-05-28T03:55:59.681Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenable Products: Network Monitor Problem Types: CWE-284 Description: In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM privileges, potentially leading to local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2025-10
CVE ID: CVE-2025-24918 State: PUBLISHED Published: 2025-11-11T16:50:08.267Z Last Updated: 2025-11-12T20:01:22.573Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Configuration Utility software and Intel(R) Server Firmware Update Utility software Problem Types: Escalation of Privilege, CWE-59 Description: Improper link resolution before file access ('link following') for some Intel(R) Server Configuration Utility software and Intel(R) Server Firmware Update Utility software before version 16.0.12. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined
: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-cent
acts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01400.html
CVE ID: CVE-2025-24919 State: PUBLISHED Published: 2025-06-13T21:48:29.351Z Last Updated: 2025-11-03T19:44:52.759Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-502 Description: A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability. Addi
tacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053
CVE ID: CVE-2025-24920 State: PUBLISHED Published: 2025-03-21T08:25:44.676Z Last Updated: 2025-03-21T12:28:00.367Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates