Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-8379 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-05T16:34:22.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05599.html - https://security.gentoo.org/glsa/201706-03 - http://www.openwall.com/lists/oss-security/2017/05/03/2 -
/msg05599.html - https://security.gentoo.org/glsa/201706-03 - http://www.openwall.com/lists/oss-security/2017/05/03/2 - https://access.redhat.com/errata/RHSA-2017:2408 - http://www.securityfocus.com/bid/98277
CVE ID: CVE-2017-8380 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-05T16:34:22.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201706-03 - https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg04147.html - http://www.securityfocus.com/bid/98303
CVE ID: CVE-2017-8381 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:34:22.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic for Windows Version 2.40 allows user-assisted remote attackers to execute code via a crafted .mkv file that is mishandled during the opening of a directory in "Browser" mode, because of a "User Mode Write AV near NULL" in XnView.exe. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-8381
CVE ID: CVE-2017-8382 State: PUBLISHED Published: 2017-05-16T10:00:00 Last Updated: 2024-08-05T16:34:22.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42005/ - http://en.0day.today/exploit/27771 - https://github.com/faizzaidi/Admidio-3.2.8-CSRF-POC-by-Provensec-llc - https://github.com/Admidio/admidio/issues/612
CVE ID: CVE-2017-8383 State: PUBLISHED Published: 2017-05-01T06:08:00 Last Updated: 2024-08-05T16:34:22.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. Additional Analyst Notes: - CVE Program Container: References: - https://craftcms.com/changelog#2-6-2976 - https://twitter.com/CraftCMS/status/857743080224473088
CVE ID: CVE-2017-8384 State: PUBLISHED Published: 2017-05-01T06:08:00 Last Updated: 2024-08-05T16:34:22.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052. Additional Analyst Notes: - CVE Program Container: References: - https://craftcms.com/changelog#2-6-2976 - https://twitter.com/CraftCMS/status/857743080224473088
CVE ID: CVE-2017-8385 State: PUBLISHED Published: 2017-05-01T06:08:00 Last Updated: 2024-08-05T16:34:22.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. Additional Analyst Notes: - CVE Program Container: References: - https://craftcms.com/changelog#2-6-2976 - https://twitter.com/CraftCMS/status/857743080224473088
CVE ID: CVE-2017-8386 State: PUBLISHED Published: 2017-06-01T16:00:00 Last Updated: 2024-08-05T16:34:22.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character. Additional Analyst Notes: - CVE Program Container: References: - http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/ - http://www.ubuntu.com/usn/USN-3287-1 - https://lists.fedoraproject.or
/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/ - http://www.ubuntu.com/usn/USN-3287-1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/ - https://security.gentoo.org/glsa/201706-04 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/ - https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/ - https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b
s-by-abusing-less-cve-2017-8386/ - https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5 - http://www.securitytracker.com/id/1038479 - https://access.redhat.com/errata/RHSA-2017:2491 - http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html - https://access.redhat.com/errata/RHSA-2017:2004 - http://www.securityfocus.com/bid/98409 - http://www.debian.org/security/2017/dsa-3848
CVE ID: CVE-2017-8387 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:34:22.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: STDU Viewer version 1.6.375 might allow user-assisted attackers to execute code via a crafted file. One threat model is a victim who obtains an untrusted crafted file from a remote location and issues several user-defined commands including Ctrl-+ commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-8387
CVE ID: CVE-2017-8388 State: PUBLISHED Published: 2017-05-01T16:00:00 Last Updated: 2024-08-05T16:34:22.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism via a register.php?act=edit&id=1 request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/semplon/GeniXCMS/issues/72
CVE ID: CVE-2017-8390 State: PUBLISHED Published: 2017-08-02T19:00:00 Last Updated: 2024-08-05T16:34:22.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a crafted domain name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99911 - http://www.securitytracker.com/id/1038976 - https://security.paloaltonetworks.com/CVE-2017-8390
CVE ID: CVE-2017-8391 State: PUBLISHED Published: 2017-05-06T00:00:00 Last Updated: 2024-08-05T16:34:22.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OS Installation Management component in CA Client Automation r12.9, r14.0, and r14.0 SP1 places an encrypted password into a readable local file during operating system installation, which allows local users to obtain sensitive information by reading this file after operating system installation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038410 - https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/
ttps://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20170504-01-security-notice-for-ca-client-automation-os-installation-mgmt.html - http://www.securityfocus.com/bid/98344
CVE ID: CVE-2017-8392 State: PUBLISHED Published: 2017-05-01T18:00:00 Last Updated: 2024-08-05T16:34:22.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the _bfd_dwarf2_find_nearest_line function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-02 - https://sourceware.org/bugzilla/show_bug.cg
rogram Container: References: - https://security.gentoo.org/glsa/201709-02 - https://sourceware.org/bugzilla/show_bug.cgi?id=21409
CVE ID: CVE-2017-8393 State: PUBLISHED Published: 2017-05-01T18:00:00 Last Updated: 2024-08-05T16:34:22.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzill
opy and strip, to crash. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=21412 - https://security.gentoo.org/glsa/201709-02
CVE ID: CVE-2017-8394 State: PUBLISHED Published: 2017-05-01T18:00:00 Last Updated: 2024-08-05T16:34:22.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=21414 - https://security.gentoo.org/glsa/201709-02
CVE ID: CVE-2017-8395 State: PUBLISHED Published: 2017-05-01T18:00:00 Last Updated: 2024-08-05T16:34:22.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc() return-value check to see if memory had actually been allocated in the _bfd_generic_get_section_contents function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=21431
Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=21431 - https://security.gentoo.org/glsa/201709-02
CVE ID: CVE-2017-8396 State: PUBLISHED Published: 2017-05-01T18:00:00 Last Updated: 2024-08-05T16:34:23.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of the reloc field. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-02 - https://sourceware.org/bugzilla/sh
: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-02 - https://sourceware.org/bugzilla/show_bug.cgi?id=21432
CVE ID: CVE-2017-8397 State: PUBLISHED Published: 2017-05-01T18:00:00 Last Updated: 2024-08-05T16:34:22.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of size 1 during processing of a corrupt binary containing reloc(s) with negative addresses. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-02 - https://sourceware.org/bugzilla/show_bug.
Program Container: References: - https://security.gentoo.org/glsa/201709-02 - https://sourceware.org/bugzilla/show_bug.cgi?id=21434
CVE ID: CVE-2017-8398 State: PUBLISHED Published: 2017-05-01T18:00:00 Last Updated: 2024-08-05T16:34:22.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-02 - https://sourceware.org/bugzilla/show_bug.cgi?id=21438
CVE ID: CVE-2017-8399 State: PUBLISHED Published: 2017-05-01T18:00:00 Last Updated: 2024-08-05T16:34:23.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pattern with very many captures." Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201710-09 - https://vcs.pcre.org/pcre2/code/tags/pcre2-10.30/ChangeLog?revision=854&view=markup - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=783 - https://vcs.pcre.org/pcre2?view=revision&revision=674 - http://www.securityfocus.com/bid/98315
CVE ID: CVE-2017-8400 State: PUBLISHED Published: 2017-05-01T19:00:00Z Last Updated: 2024-09-16T23:00:56.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS; it might cause arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/13
CVE ID: CVE-2017-8401 State: PUBLISHED Published: 2017-05-01T19:00:00Z Last Updated: 2024-09-17T00:31:23.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png_load() in lib/png.c:724. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/14
CVE ID: CVE-2017-8402 State: PUBLISHED Published: 2017-05-31T03:54:00 Last Updated: 2024-08-05T16:34:22.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/pivot-weblog/code/4489/
CVE ID: CVE-2017-8403 State: PUBLISHED Published: 2017-05-01T20:00:00Z Last Updated: 2024-09-16T16:22:51.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: 360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing procedure, which is available at any time and does not require a password. This affects firmware 2.1.4. Exploitation can use the 360fly Android or iOS application, or the BlueZ gatttool program. Additional Analyst Notes: - CVE Program Container: References: - https://www.slideshare.net/fuguet/bluediot-when-a-mature-and-immature-technology-mixes-becomes-an-idiot-situation-75529672
CVE ID: CVE-2017-8404 State: PUBLISHED Published: 2019-07-02T18:47:23 Last Updated: 2024-08-05T16:34:23.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains th
n the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed
function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x0008F598 which calls the "mailLoginTest" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8405 State: PUBLISHED Published: 2019-07-02T19:38:02 Last Updated: 2024-08-05T16:34:23.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the
/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-D
m Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8406 State: PUBLISHED Published: 2019-07-02T19:05:07 Last Updated: 2024-08-05T16:34:23.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case, user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user
device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user's browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file's response and displays it inside a Textfield. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1
0-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8407 State: PUBLISHED Published: 2019-07-02T18:53:24 Last Updated: 2024-08-05T16:34:23.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change the user's password. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/file
es: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8408 State: PUBLISHED Published: 2019-07-02T15:46:01 Last Updated: 2024-08-05T16:34:22.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the f
he device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call. Additional Analyst Notes: - CVE Program Container: References: -