Dunateo/VulnDesc_CWE_Mapping huggingface dataset:
In the Linux kernel, the following vulnerability has been resolved:ipvlan: Fix out-of-bound bugs caused by unset skb->mac_headerIf an AF_PACKET socket is used to send packets through ipvlan and thedefault xmit function of the AF_PACKET socket is changed fromdev_queue_xmit() to packet_direct_xmit() via setsockopt() with the optionname of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset andremains as the initial value of 65535, this may trigger slab-out-of-boundsbugs as following:=================================================================UG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]PU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6ardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33all Trace:print_address_description.constprop.0+0x1d/0x160print_report.cold+0x4f/0x112kasan_report+0xa3/0x130ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]ipvlan_start_xmit+0x29/0xa0 [ipvlan]__dev_direct_xmit+0x2e2/0x380packet_direct_xmit+0x22/0x60packet_snd+0x7c9/0xc40sock_sendmsg+0x9a/0xa0__sys_sendto+0x18a/0x230__x64_sys_sendto+0x74/0x90do_syscall_64+0x3b/0x90entry_SYSCALL_64_after_hwframe+0x63/0xcdThe root cause is:  1. packet_snd() only reset skb->mac_header when sock->type is SOCK_RAW     and skb->protocol is not specified as in packet_parse_headers()  2. packet_direct_xmit() doesn't reset skb->mac_header as dev_queue_xmit()In this case, skb->mac_header is 65535 when ipvlan_xmit_mode_l2() iscalled. So when ipvlan_xmit_mode_l2() gets mac header with eth_hdr() whichuse "skb->head + skb->mac_header", out-of-bound access occurs.This patch replaces eth_hdr() with skb_eth_hdr() in ipvlan_xmit_mode_l2()and reset mac header in multicast to solve this out-of-bound bug.
Weakness: CWE-125 Out-of-bounds Read
An issue was discovered in Logpoint before 7.1.1. Template injection was seen in the search template. The search template uses jinja templating for generating dynamic data. This could be abused to achieve code execution. Any user with access to create a search template can leverage this to execute code as the loginspect user.
Weakness: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
An issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file clean_secbi_old_logs is writable by all users and is executed as root, leading to privilege escalation.
Weakness: CWE-276 Incorrect Default Permissions
In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp.
Weakness: CWE-732 Incorrect Permission Assignment for Critical Resource
In the Linux kernel, the following vulnerability has been resolved:phylib: fix potential use-after-freeCommit bafbdd527d56 ("phylib: Add device reset GPIO support") added callto phy_device_reset(phydev) after the put_device() call in phy_detach().The comment before the put_device() call says that the phydev might goaway with put_device().Fix potential use-after-free by calling phy_device_reset() beforeput_device().
Weakness: CWE-416 Use After Free
In the Linux kernel, the following vulnerability has been resolved:sfc/siena: fix null pointer dereference in efx_hard_start_xmitLike in previous patch for sfc, prevent potential (but unlikely) NULLpointer dereference.
Weakness: CWE-476 NULL Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:scsi: core: Fix a use-after-freeThere are two .exit_cmd_priv implementations. Both implementations useresources associated with the SCSI host. Make sure that these resources arestill available when .exit_cmd_priv is called by waiting insidescsi_remove_host() until the tag set has been freed.This commit fixes the following use-after-free:==================================================================BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]Read of size 8 at addr ffff888100337000 by task multipathd/16727Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Weakness: CWE-416 Use After Free
In the Linux kernel, the following vulnerability has been resolved:peci: cpu: Fix use-after-free in adev_release()When auxiliary_device_add() returns an error, auxiliary_device_uninit()is called, which causes refcount for device to be decremented and.release callback will be triggered.Because adev_release() re-calls auxiliary_device_uninit(), it will causeuse-after-free:[ 1269.455172] WARNING: CPU: 0 PID: 14267 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15[ 1269.464007] refcount_t: underflow
Weakness: CWE-416 Use After Free
Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor's position is that this is a design choice, not a vulnerability
Weakness: CWE-345 Insufficient Verification of Data Authenticity
A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofing as the browser only display certain part of the entire URL.
Weakness: CWE-290 Authentication Bypass by Spoofing
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.
Weakness: CWE-306 Missing Authentication for Critical Function
Apport does not disable python crash handler before entering chroot
Weakness: CWE-400 Uncontrolled Resource Consumption
A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update. If amalicious actor successfully exploits this vulnerability, theycould use it to update the RTU500 with unsigned firmware.
Weakness: CWE-358 Improperly Implemented Security Check for Standard
The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.
Weakness: CWE-284 Improper Access Control
A race condition was identified through which privilege escalation was possible in certain configurations.
Weakness: CWE-1223 Race Condition for Write-Once Attributes
Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted URL. (Chromium security severity: Medium)
Weakness: CWE-474 Use of Function with Inconsistent Implementations
In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function. 
Weakness: CWE-400 Uncontrolled Resource Consumption
`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
Weakness: CWE-680 Integer Overflow to Buffer Overflow
The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.
Weakness: CWE-31 Path Traversal: 'dir\..\..\filename'
By default, SANnav OVA is shipped with root user login enabled.  While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account. 
Weakness: CWE-269 Improper Privilege Management
The AGCA  WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges  in Citrix Workspace app for Windows
Weakness: CWE-269 Improper Privilege Management
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-358 Improperly Implemented Security Check for Standard
Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
Weakness: CWE-823 Use of Out-of-range Pointer Offset
Use after free in Downloads in Google Chrome on iOS prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials.
Weakness: CWE-250 Execution with Unnecessary Privileges
Use after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
The Slider by 10Web  WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.
Weakness: CWE-611 Improper Restriction of XML External Entity Reference
Use after free in User Education in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Weakness: CWE-416 Use After Free
Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128.
Weakness: CWE-277 Insecure Inherited Permissions
Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Weakness: CWE-122 Heap-based Buffer Overflow
Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
Weakness: CWE-358 Improperly Implemented Security Check for Standard
CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS
Weakness: CWE-269 Improper Privilege Management
The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized (no class whitelist). An attacker can construct a crafted Iced model that uses Java gadgets and leads to arbitrary code execution when imported to the H2O platform.
Weakness: CWE-502 Deserialization of Untrusted Data
Sensitive information disclosure in NetScaler Console
Weakness: CWE-287 Improper Authentication
Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
Denial of Service   in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX
Weakness: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Weakness: CWE-1275 Sensitive Cookie with Improper SameSite Attribute
Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
Weakness: CWE-366 Race Condition within a Thread
Use after free in Tabs in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Weakness: CWE-416 Use After Free
Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.The lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
There is a MEDIUM severity vulnerability affecting CPython.The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)
Weakness: CWE-457 Use of Uninitialized Variable
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-358 Improperly Implemented Security Check for Standard
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-358 Improperly Implemented Security Check for Standard
Out of bounds memory access in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-125 Out-of-bounds Read
Use after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.
Weakness: CWE-1262 Improper Access Control for Register Interface
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
Weakness: CWE-20 Improper Input Validation
Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
A signal handler in sshd(8) may call a logging function that is not async-signal-safe.  The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default).  This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges.This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh.  The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD.As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.
Weakness: CWE-364 Signal Handler Race Condition
ANGLE failed to initialize parameters which led to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
Weakness: CWE-908 Use of Uninitialized Resource
Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129.
Weakness: CWE-416 Use After Free
Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)
Weakness: CWE-807 Reliance on Untrusted Inputs in a Security Decision
Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
Weakness: CWE-755 Improper Handling of Exceptional Conditions
Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Weakness: CWE-358 Improperly Implemented Security Check for Standard
Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-416 Use After Free
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
Weakness: CWE-787 Out-of-bounds Write
Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weakness: CWE-122 Heap-based Buffer Overflow