Dunateo/VulnDesc_CWE_Mapping huggingface dataset:
Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges.
Weakness: CWE-250 Execution with Unnecessary Privileges
Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper authentication controls when accessing the Ckeditor file manager functionality.
Weakness: CWE-434 Unrestricted Upload of File with Dangerous Type
modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).
Weakness: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database.  
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Weakness: CWE-707 Improper Neutralization
An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can exploit this by sending a POST request to the vulnerable PHP page. An attacker can elevate to root permissions with Sudo.
Weakness: CWE-918 Server-Side Request Forgery (SSRF)
An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
Weakness: CWE-284 Improper Access Control
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
Weakness: CWE-284 Improper Access Control
Cross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to function user_add.\
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
Weakness: CWE-253 Incorrect Check of Function Return Value
In the Linux kernel, the following vulnerability has been resolved:fs/jfs: Add check for negative db_l2nbperpagel2nbperpage is log2(number of blks per page), and the minimum legalvalue should be 0, not negative.In the case of l2nbperpage being negative, an error will occurwhen subsequently used as shift exponent.Syzbot reported this bug:UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12shift exponent -16777216 is negative
Weakness: CWE-1335 Incorrect Bitwise Shift of Integer
The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512*i-2, for i=9, i=10, i=11, etc.
Weakness: CWE-122 Heap-based Buffer Overflow
In the Linux kernel, the following vulnerability has been resolved:rpmsg: virtio: Free driver_override when rpmsg_remove()Free driver_override when rpmsg_remove(), otherwisethe following memory leak will occur:unreferenced object 0xffff0000d55d7080 (size 128):  comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s)  hex dump (first 32 bytes):    72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00  rpmsg_ns........    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................  backtrace:    [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320    [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70    [<00000000228a60c3>] kstrndup+0x4c/0x90    [<0000000077158695>] driver_set_override+0xd0/0x164    [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170    [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30    [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec    [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280    [<00000000443331cc>] really_probe+0xbc/0x2dc    [<00000000391064b1>] __driver_probe_device+0x78/0xe0    [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160    [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140    [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4    [<000000003b929a36>] __device_attach+0x9c/0x19c    [<00000000a94e0ba8>] device_initial_probe+0x14/0x20    [<000000003c999637>] bus_probe_device+0xa0/0xac
Weakness: CWE-401 Missing Release of Memory after Effective Lifetime
In the Linux kernel, the following vulnerability has been resolved:bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itselfsock_map proto callbacks should never call themselves by design. Protectagainst bugs like [1] and break out of the recursive loop to avoid a stackoverflow in favor of a resource leak.[1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.
Weakness: CWE-798 Use of Hard-coded Credentials
The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie (if signed cookies are disabled).
Weakness: CWE-269 Improper Privilege Management
In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix slab out of bounds write in smb_inherit_dacl()slab out-of-bounds write is caused by that offsets is bigger than pntsdallocation size. This patch add the check to validate 3 offsets usingallocation size.
Weakness: CWE-787 Out-of-bounds Write
In the Linux kernel, the following vulnerability has been resolved:s390/decompressor: specify __decompress() buf len to avoid overflowHistorically calls to __decompress() didn't specify "out_len" parameteron many architectures including s390, expecting that no writes beyonduncompressed kernel image are performed. This has changed since commit2aa14b1ab2c4 ("zstd: import usptream v1.5.2") which includes zstd librarycommit 6a7ede3dfccb ("Reduce size of dctx by reutilizing dst buffer(#2751)"). Now zstd decompression code might store literal buffer inthe unwritten portion of the destination buffer. Since "out_len" isnot set, it is considered to be unlimited and hence free to use foroptimization needs. On s390 this might corrupt initrd or ipl reportwhich are often placed right after the decompressor buffer. Luckily thesize of uncompressed kernel image is already known to the decompressor,so to avoid the problem simply specify it in the "out_len" parameter.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Open Networking Foundation SD-RAN ONOS onos-kpimon 0.4.7 allows blocking of the errCh channel within the Start function of the monitoring package.
Weakness: CWE-787 Out-of-bounds Write
In the Linux kernel, the following vulnerability has been resolved:drm: bridge: it66121: Fix invalid connector dereferenceFix the NULL pointer dereference when no monitor is connected, and thesound card is opened from userspace.Instead return an empty buffer (of zeroes) as the EDID information tothe sound framework if there is no connector attached.
Weakness: CWE-476 NULL Pointer Dereference
Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 221019) is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code. Exploiting the vulnerability requires authentication.
Weakness: CWE-121 Stack-based Buffer Overflow
A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.
Weakness: CWE-59 Improper Link Resolution Before File Access ('Link Following')
In the Linux kernel, the following vulnerability has been resolved:smb: client: fix use-after-free bug in cifs_debug_data_proc_show()Skip SMB sessions that are being teared down(e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show()to avoid use-after-free in @ses.This fixes the following GPF when reading from /proc/fs/cifs/DebugDatawhile mounting and umounting  [ 816.251274] general protection fault, probably for non-canonical  address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI  ...  [  816.260138] Call Trace:  [  816.260329]  <TASK>  [  816.260499]  ? die_addr+0x36/0x90  [  816.260762]  ? exc_general_protection+0x1b3/0x410  [  816.261126]  ? asm_exc_general_protection+0x26/0x30  [  816.261502]  ? cifs_debug_tcon+0xbd/0x240 [cifs]  [  816.261878]  ? cifs_debug_tcon+0xab/0x240 [cifs]  [  816.262249]  cifs_debug_data_proc_show+0x516/0xdb0 [cifs]  [  816.262689]  ? seq_read_iter+0x379/0x470  [  816.262995]  seq_read_iter+0x118/0x470  [  816.263291]  proc_reg_read_iter+0x53/0x90  [  816.263596]  ? srso_alias_return_thunk+0x5/0x7f  [  816.263945]  vfs_read+0x201/0x350  [  816.264211]  ksys_read+0x75/0x100  [  816.264472]  do_syscall_64+0x3f/0x90  [  816.264750]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8  [  816.265135] RIP: 0033:0x7fd5e669d381
Weakness: CWE-416 Use After Free
In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: Fix possible null pointer dereferenceabo->tbo.resource may be NULL in amdgpu_vm_bo_update.
Weakness: CWE-476 NULL Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:iommufd: Fix missing update of domains_itree after splitting iopt_areaIn iopt_area_split(), if the original iopt_area has filled a domain and islinked to domains_itree, pages_nodes have to be properlyreinserted. Otherwise the domains_itree becomes corrupted and we will UAF.
Weakness: CWE-284 Improper Access Control
In the Linux kernel, the following vulnerability has been resolved:mfd: qcom-spmi-pmic: Fix revid implementationThe Qualcomm SPMI PMIC revid implementation is broken in multiple ways.First, it assumes that just because the sibling base device has beenregistered that means that it is also bound to a driver, which may notbe the case (e.g. due to probe deferral or asynchronous probe). Thiscould trigger a NULL-pointer dereference when attempting to access thedriver data of the unbound device.Second, it accesses driver data of a sibling device directly and withoutany locking, which means that the driver data may be freed while it isbeing accessed (e.g. on driver unbind).Third, it leaks a struct device reference to the sibling device which islooked up using the spmi_device_from_of() every time a function (child)device is calling the revid function (e.g. on probe).Fix this mess by reimplementing the revid lookup so that it is done onlyat probe of the PMIC device
Weakness: CWE-476 NULL Pointer Dereference
In Plaintext COUNTER CHECK message accepted before AS security activation, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: Fix potential null pointer derefernceThe amdgpu_ras_get_context may return NULL if devicenot support ras feature, so add check before using.
Weakness: CWE-476 NULL Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:powerpc/powernv: Add a null pointer check in opal_powercap_init()kasprintf() returns a pointer to dynamically allocated memorywhich can be NULL upon failure.
Weakness: CWE-476 NULL Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:jfs: fix slab-out-of-bounds Read in dtSearchCurrently while searching for current page in the sorted entry tableof the page there is a out of bound access. Added a bound check to fixthe error.Dave:Set return code to -EIO
Weakness: CWE-400 Uncontrolled Resource Consumption
In the Linux kernel, the following vulnerability has been resolved:clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_dataAdd the check for the return value of mtk_alloc_clk_data() in order toavoid NULL pointer dereference.
Weakness: CWE-476 NULL Pointer Dereference
Open Networking Foundation SD-RAN ONOS onos-ric-sdk-go 0.8.12 allows infinite repetition of the processing of an error (in the Subscribe function implementation for the subscribed indication stream).
Weakness: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
In the Linux kernel, the following vulnerability has been resolved:pstore/platform: Add check for kstrdupAdd check for the return value of kstrdup() and return the errorif it fails in order to avoid NULL pointer dereference.
Weakness: CWE-476 NULL Pointer Dereference
In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.
Weakness: CWE-805 Buffer Access with Incorrect Length Value
In the Linux kernel, the following vulnerability has been resolved:sh: push-switch: Reorder cleanup operations to avoid use-after-free bugThe original code puts flush_work() before timer_shutdown_sync()in switch_drv_remove(). Although we use flush_work() to stopthe worker, it could be rescheduled in switch_timer(). As a result,a use-after-free bug can occur. The details are shown below:      (cpu 0)                    |      (cpu 1)switch_drv_remove()              | flush_work()                    |  ...                            |  switch_timer // timer                                 |   schedule_work(&psw->work) timer_shutdown_sync()           | ...                             |  switch_work_handler // worker kfree(psw) // free              |                                 |   psw->state = 0 // useThis patch puts timer_shutdown_sync() before flush_work() tomitigate the bugs. As a result, the worker and timer will bestopped safely before the deallocate operations.
Weakness: CWE-416 Use After Free
In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: don't return unset power in ieee80211_get_tx_power()We can get a UBSAN warning if ieee80211_get_tx_power() returns theINT_MIN value mac80211 internally uses for "unset power level". UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 100 cannot be represented in type 'int' CPU: 0 PID: 20433 Comm: insmod Tainted: G        WC OE Call Trace:  dump_stack+0x74/0x92  ubsan_epilogue+0x9/0x50  handle_overflow+0x8d/0xd0  __ubsan_handle_mul_overflow+0xe/0x10  nl80211_send_iface+0x688/0x6b0 [cfg80211]  [...]  cfg80211_register_wdev+0x78/0xb0 [cfg80211]  cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211]  [...]  ieee80211_if_add+0x60e/0x8f0 [mac80211]  ieee80211_register_hw+0xda5/0x1170 [mac80211]In this case, simply return an error instead, to indicatethat no data is available.
Weakness: CWE-920 Improper Restriction of Power Consumption
Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrity.
Weakness: CWE-284 Improper Access Control
In the Linux kernel, the following vulnerability has been resolved:pipe: wakeup wr_wait after setting max_usageCommit c73be61cede5 ("pipe: Add general notification queue support") aregression was introduced that would lock up resized pipes under certainconditions. See the reproducer in [1].The commit resizing the pipe ring size was moved to a differentfunction, doing that moved the wakeup for pipe->wr_wait before actuallyraising pipe->max_usage. If a pipe was full before the resize occured itwould result in the wakeup never actually triggering pipe_write.Set @max_usage and @nr_accounted before waking writers if this isn't awatch queue.[Christian Brauner <brauner@kernel.org>: rewrite to account for watch queues]
Weakness: CWE-400 Uncontrolled Resource Consumption
SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Rebinding attack.
Weakness: CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
Vulnerability of package name verification being bypassed in the HwIms module.Impact: Successful exploitation of this vulnerability will affect availability.
Weakness: CWE-280 Improper Handling of Insufficient Permissions or Privileges
In the Linux kernel, the following vulnerability has been resolved:media: vidtv: psi: Add check for kstrdupAdd check for the return value of kstrdup() and return the errorif it fails in order to avoid NULL pointer dereference.
Weakness: CWE-476 NULL Pointer Dereference
IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT->GetVariable() function. Attackers with access to local NVRAM variables can exploit this by modifying these variables on SPI Flash, resulting in memory data being tampered with. When critical data in memory data is tampered with,a crash may occur.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks.
Weakness: CWE-942 Permissive Cross-domain Policy with Untrusted Domains
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
Weakness: CWE-680 Integer Overflow to Buffer Overflow
An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via the router's authentication mechanism.
Weakness: CWE-288 Authentication Bypass Using an Alternate Path or Channel
The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack.  The attack would be activated by an end user clicking it.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must have physical USB access to the device in order to exploit this vulnerability.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
Weakness: CWE-706 Use of Incorrectly-Resolved Name or Reference
Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrator role.  This issue has been fixed in FileMaker Server 20.3.1 by eliminating the send of Admin Role passwords in the Node.js socket.
Weakness: CWE-257 Storing Passwords in a Recoverable Format
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox restrictions.
Weakness: CWE-693 Protection Mechanism Failure
A race condition was addressed with improved state handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privileges.
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk access permissions.
Weakness: CWE-922 Insecure Storage of Sensitive Information
Improper neutralization in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Weakness: CWE-707 Improper Neutralization
An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed script to the Sui node component.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin privileges without proper authentication.
Weakness: CWE-280 Improper Handling of Insufficient Permissions or Privileges
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
Weakness: CWE-125 Out-of-bounds Read
Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function.
Weakness: CWE-284 Improper Access Control
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Weakness: CWE-1333 Inefficient Regular Expression Complexity
Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-288 Authentication Bypass Using an Alternate Path or Channel
SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.
Weakness: CWE-352 Cross-Site Request Forgery (CSRF)
Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-863 Incorrect Authorization