Dunateo/VulnDesc_CWE_Mapping huggingface dataset:
In the Linux kernel, the following vulnerability has been resolved:usb: gadget: f_fs: Fix race between aio_cancel() and AIO request completeFFS based applications can utilize the aio_cancel() callback to dequeuepending USB requests submitted to the UDC.  There is a scenario where theFFS application issues an AIO cancel call, while the UDC is handling asoft disconnect.  For a DWC3 based implementation, the callstack lookslike the following:    DWC3 Gadget                               FFS Applicationdwc3_gadget_soft_disconnect()              ...  --> dwc3_stop_active_transfers()    --> dwc3_gadget_giveback(-ESHUTDOWN)      --> ffs_epfile_async_io_complete()   ffs_aio_cancel()        --> usb_ep_free_request()            --> usb_ep_dequeue()There is currently no locking implemented between the AIO completionhandler and AIO cancel, so the issue occurs if the completion routine isrunning in parallel to an AIO cancel call coming from the FFS application.As the completion call frees the USB request (io_data->req) the FFSapplication is also referencing it for the usb_ep_dequeue() call.  This canlead to accessing a stale/hanging pointer.commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently")relocated the usb_ep_free_request() into ffs_epfile_async_io_complete().However, in order to properly implement locking to mitigate this issue, thespinlock can't be added to ffs_epfile_async_io_complete(), asusb_ep_dequeue() (if successfully dequeuing a USB request) will call thefunction driver's completion handler in the same context.  Hence, leadinginto a deadlock.Fix this issue by moving the usb_ep_free_request() back toffs_user_copy_worker(), and ensuring that it explicitly sets io_data->reqto NULL after freeing it within the ffs->eps_lock.  This resolves the racecondition above, as the ffs_aio_cancel() routine will not continueattempting to dequeue a request that has already been freed, or theffs_user_copy_work() not freeing the USB request until the AIO cancel isdone referencing it.This fix depends on  commit b566d38857fc ("usb: gadget: f_fs: use io_data->status  consistently")
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary.
Weakness: CWE-269 Improper Privilege Management
Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php.
Weakness: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
This vulnerability is similar to, but not identical to, CVE-2024-36303.
Weakness: CWE-346 Origin Validation Error
Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4. If this vulnerability is exploited, a logged-in user may obtain or delete arbitrary files on the server (within the privilege of the Redmine process).
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
In the Linux kernel, the following vulnerability has been resolved:keys: Fix overwrite of key expiration on instantiationThe expiry time of a key is unconditionally overwritten duringinstantiation, defaulting to turn it permanent. This causes a problemfor DNS resolution as the expiration set by user-space is overwritten toTIME64_MAX, disabling further DNS updates. Fix this by restoring thecondition that key_set_expiry is only called when the pre-parser sets aspecific expiry.
Weakness: CWE-324 Use of a Key Past its Expiration Date
Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7D25v14, 7D25v17 to 7D25v19, and 7D25v1A to 7D25v1H was discovered to contain a write-what-where condition in the in the SW handler for SMI 0xE3. Motherboard's with the following chipsets are affected: Intel 300, Intel 400, Intel 500, Intel 600, Intel 700, AMD 300, AMD 400, AMD 500, AMD 600 and AMD 700.
Weakness: CWE-123 Write-what-where Condition
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-281 Improper Preservation of Permissions
Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-1259 Improper Restriction of Security Token Assignment
In the Linux kernel, the following vulnerability has been resolved:af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.Billy Jheng Bing-Jhong reported a race between __unix_gc() andqueue_oob().__unix_gc() tries to garbage-collect close()d inflight sockets,and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GCwill drop the reference and set NULL to it locklessly.However, the peer socket still can send MSG_OOB message andqueue_oob() can update unix_sk(sk)->oob_skb concurrently, leadingNULL pointer dereference. [0]To fix the issue, let's update unix_sk(sk)->oob_skb under thesk_receive_queue's lock and take it everywhere we touch oob_skb.Note that we defer kfree_skb() in manage_oob() to silence lockdepfalse-positive (See [1]).[0]:BUG: kernel NULL pointer dereference, address: 0000000000000008 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present pagePGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0Oops: 0002 [#1] PREEMPT SMP PTICPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014Workqueue: events delayed_fputRIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847)Code: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 <48> 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc ccRSP: 0018:ffffc900001bfd48 EFLAGS: 00000002RAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00RBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001R10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00R13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80FS:  0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0PKRU: 55555554Call Trace: <TASK> unix_release_sock (net/unix/af_unix.c:654) unix_release (net/unix/af_unix.c:1050) __sock_release (net/socket.c:660) sock_close (net/socket.c:1423) __fput (fs/file_table.c:423) delayed_fput (fs/file_table.c:444 (discriminator 3)) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:257) </TASK>Modules linked in:CR2: 0000000000000008
Weakness: CWE-476 NULL Pointer Dereference
Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. This occurs because of an Untrusted Search Path.
Weakness: CWE-426 Untrusted Search Path
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root.
Weakness: CWE-379 Creation of Temporary File in Directory with Insecure Permissions
Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.tensordot.
Weakness: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen.
Weakness: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.
Weakness: CWE-323 Reusing a Nonce, Key Pair in Encryption
Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscrypt-proxy.
Weakness: CWE-266 Incorrect Privilege Assignment
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
Weakness: CWE-35 Path Traversal: '.../...//'
Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
Weakness: CWE-121 Stack-based Buffer Overflow
In the Linux kernel, the following vulnerability has been resolved:Drivers: hv: vmbus: Leak pages if set_memory_encrypted() failsIn CoCo VMs it is possible for the untrusted host to causeset_memory_encrypted() or set_memory_decrypted() to fail such that anerror is returned and the resulting memory is shared. Callers need totake care to handle these errors to avoid returning decrypted (shared)memory to the page allocator, which could lead to functional or securityissues.VMBus code could free decrypted pages if set_memory_encrypted()/decrypted()fails. Leak the pages if this happens.
Weakness: CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information
SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive information via the id parameter to news_details.php and location_details.php
Weakness: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action vlan_setting with a sufficiently long dns1 or dns 2 key.
Weakness: CWE-121 Stack-based Buffer Overflow
In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information.
Weakness: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. The affected app cannot detect event data with invalid signatures.
Weakness: CWE-347 Improper Verification of Cryptographic Signature
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings.
Weakness: CWE-284 Improper Access Control
A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.
Weakness: CWE-352 Cross-Site Request Forgery (CSRF)
In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session.
Weakness: CWE-279 Incorrect Execution-Assigned Permissions
In the Linux kernel, the following vulnerability has been resolved:workqueue: Fix selection of wake_cpu in kick_pool()With cpu_possible_mask=0-63 and cpu_online_mask=0-7 the followingkernel oops was observed:smp: Bringing up secondary CPUs ...smp: Brought up 1 node, 8 CPUsUnable to handle kernel pointer dereference in virtual kernel address spaceFailing address: 0000000000000000 TEID: 0000000000000803[..] Call Trace:arch_vcpu_is_preempted+0x12/0x80select_idle_sibling+0x42/0x560select_task_rq_fair+0x29a/0x3b0try_to_wake_up+0x38e/0x6e0kick_pool+0xa4/0x198__queue_work.part.0+0x2bc/0x3a8call_timer_fn+0x36/0x160__run_timers+0x1e2/0x328__run_timer_base+0x5a/0x88run_timer_softirq+0x40/0x78__do_softirq+0x118/0x388irq_exit_rcu+0xc0/0xd8do_ext_irq+0xae/0x168ext_int_handler+0xbe/0xf0psw_idle_exit+0x0/0xcdefault_idle_call+0x3c/0x110do_idle+0xd4/0x158cpu_startup_entry+0x40/0x48rest_init+0xc6/0xc8start_kernel+0x3c4/0x5e0startup_continue+0x3c/0x50The crash is caused by calling arch_vcpu_is_preempted() for an offlineCPU. To avoid this, select the cpu with cpumask_any_and_distribute()to mask __pod_cpumask with cpu_online_mask. In case no cpu is left inthe pool, skip the assignment.tj: This doesn't fully fix the bug as CPUs can still go down between pickingthe target CPU and the wake call. Fixing that likely requires addingcpu_online() test to either the sched or s390 arch code. However, regardlessof how that is fixed, workqueue shouldn't be picking a CPU which isn'tonline as that would result in unpredictable and worse behavior.
Weakness: CWE-476 NULL Pointer Dereference
Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API.
Weakness: CWE-400 Uncontrolled Resource Consumption
Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c406490 (for IoAllocateMdl, MmBuildMdlForNonPagedPool, and MmMapLockedPages), leading to NT AUTHORITY\SYSTEM privilege escalation.
Weakness: CWE-269 Improper Privilege Management
In the Linux kernel, the following vulnerability has been resolved:ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()The documentation for device_get_named_child_node() mentions thisimportant point:"The caller is responsible for calling fwnode_handle_put() on thereturned fwnode pointer."Add fwnode_handle_put() to avoid a leaked reference.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may be referred, a webpage may be altered, or a server may be permanently halted.
Weakness: CWE-280 Improper Handling of Insufficient Permissions or Privileges
An issue in the oneflow.scatter_nd parameter OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index parameter exceeds the range of shape.
Weakness: CWE-20 Improper Input Validation
TOTOLINK AC1200 Wireless Dual Band Gigabit Router firmware A3100R V4.1.2cu.5247_B20211129, in the cgi function `setNoticeCfg` of the file `/lib/cste_modules/system.so`, the length of the user input string `NoticeUrl` is not checked. This can lead to a buffer overflow, allowing attackers to construct malicious HTTP or MQTT requests to cause a denial-of-service attack.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-278 Insecure Preserved Inherited Permissions
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.
Weakness: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to downgrade the firmware version or change the downloading URL via a man-in-the-middle attack.
Weakness: CWE-599 Missing Validation of OpenSSL Certificate
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-277 Insecure Inherited Permissions
A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c.
Weakness: CWE-122 Heap-based Buffer Overflow
A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.
Weakness: CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.dot.
Weakness: CWE-400 Uncontrolled Resource Consumption
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.
Weakness: CWE-613 Insufficient Session Expiration
In the Linux kernel, the following vulnerability has been resolved:tty: n_gsm: fix possible out-of-bounds in gsm0_receive()Assuming the following:- side A configures the n_gsm in basic option mode- side B sends the header of a basic option mode frame with data length 1- side A switches to advanced option mode- side B sends 2 data bytes which exceeds gsm->len  Reason: gsm->len is not used in advanced option mode.- side A switches to basic option mode- side B keeps sending until gsm0_receive() writes past gsm->buf  Reason: Neither gsm->state nor gsm->len have been reset after  reconfiguration.Fix this by changing gsm->count to gsm->len comparison from equal to lessthan. Also add upper limit checks against the constant MAX_MRU ingsm0_receive() and gsm1_receive() to harden against memory corruption ofgsm->len and gsm->mru.All other checks remain as we still need to limit the data according to theuser configuration and actual payload size.
Weakness: CWE-125 Out-of-bounds Read
In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-284 Improper Access Control
Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-284 Improper Access Control
Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. The attacker can elevate their privilege to the internal system role, which allows them to execute commands on the server. This affects February 2024 Patch 3 (14.173.3 through 14.173.7), November 2023 Patch 8 (14.159.4 through 14.159.13), August 2023 Patch 13 (14.139.3 through 14.139.20), May 2023 Patch 15 (14.129.3 through 14.129.22), February 2023 Patch 13 (14.113.1 through 14.113.18), November 2022 Patch 13 (14.97.2 through 14.97.18), August 2022 Patch 16 (14.78.3 through 14.78.23), and May 2022 Patch 17 (14.67.7 through 14.67.31). This has been fixed in May 2024 (14.187.4), February 2024 Patch 4 (14.173.8), November 2023 Patch 9 (14.159.14), August 2023 Patch 14 (14.139.21), May 2023 Patch 16 (14.129.23), February 2023 Patch 14 (14.113.19), November 2022 Patch 14 (14.97.19), August 2022 Patch 17 (14.78.25), and May 2022 Patch 18 (14.67.34).
Weakness: CWE-269 Improper Privilege Management
The file-serving function in TARGIT Decision Suite 23.2.15007 allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file.
Weakness: CWE-918 Server-Side Request Forgery (SSRF)
A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')