Dunateo/VulnDesc_CWE_Mapping huggingface dataset:
OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets.
Weakness: CWE-620 Unverified Password Change
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.
Weakness: CWE-122 Heap-based Buffer Overflow
OS command injection vulnerability in WRC-X3200GST3-B v1.25 and earlier, and WRC-G01-W v1.24 and earlier allows a network-adjacent attacker with credentials to execute arbitrary OS commands by sending a specially crafted request to the product.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In the Linux kernel, the following vulnerability has been resolved:tcp: Fix refcnt handling in __inet_hash_connect().syzbot reported a warning in sk_nulls_del_node_init_rcu().The commit 66b60b0c8c4a ("dccp/tcp: Unhash sk from ehash for tb2 allocfailure after check_estalblished().") tried to fix an issue that anunconnected socket occupies an ehash entry when bhash2 allocation fails.In such a case, we need to revert changes done by check_established(),which does not hold refcnt when inserting socket into ehash.So, to revert the change, we need to __sk_nulls_add_node_rcu() insteadof sk_nulls_add_node_rcu().Otherwise, sock_put() will cause refcnt underflow and leak the socket.[0]:WARNING: CPU: 0 PID: 23948 at include/net/sock.h:799 sk_nulls_del_node_init_rcu+0x166/0x1a0 include/net/sock.h:799Modules linked in:CPU: 0 PID: 23948 Comm: syz-executor.2 Not tainted 6.8.0-rc6-syzkaller-00159-gc055fc00c07b #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024RIP: 0010:sk_nulls_del_node_init_rcu+0x166/0x1a0 include/net/sock.h:799Code: e8 7f 71 c6 f7 83 fb 02 7c 25 e8 35 6d c6 f7 4d 85 f6 0f 95 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 1b 6d c6 f7 90 <0f> 0b 90 eb b2 e8 10 6d c6 f7 4c 89 e7 be 04 00 00 00 e8 63 e7 d2RSP: 0018:ffffc900032d7848 EFLAGS: 00010246RAX: ffffffff89cd0035 RBX: 0000000000000001 RCX: 0000000000040000RDX: ffffc90004de1000 RSI: 000000000003ffff RDI: 0000000000040000RBP: 1ffff1100439ac26 R08: ffffffff89ccffe3 R09: 1ffff1100439ac28R10: dffffc0000000000 R11: ffffed100439ac29 R12: ffff888021cd6140R13: dffffc0000000000 R14: ffff88802a9bf5c0 R15: ffff888021cd6130FS:  00007f3b823f16c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f3b823f0ff8 CR3: 000000004674a000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK> __inet_hash_connect+0x140f/0x20b0 net/ipv4/inet_hashtables.c:1139 dccp_v6_connect+0xcb9/0x1480 net/dccp/ipv6.c:956 __inet_stream_connect+0x262/0xf30 net/ipv4/af_inet.c:678 inet_stream_connect+0x65/0xa0 net/ipv4/af_inet.c:749 __sys_connect_file net/socket.c:2048 [inline] __sys_connect+0x2df/0x310 net/socket.c:2065 __do_sys_connect net/socket.c:2075 [inline] __se_sys_connect net/socket.c:2072 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2072 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77RIP: 0033:0x7f3b8167dda9Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007f3b823f10c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002aRAX: ffffffffffffffda RBX: 00007f3b817abf80 RCX: 00007f3b8167dda9RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003RBP: 00007f3b823f1120 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001R13: 000000000000000b R14: 00007f3b817abf80 R15: 00007ffd3beb57b8 </TASK>
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
In the Linux kernel, the following vulnerability has been resolved:nouveau: fix instmem race condition around ptr storesRunning a lot of VK CTS in parallel against nouveau, once everyfew hours you might see something like this crash.BUG: kernel NULL pointer dereference, address: 0000000000000008PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0Oops: 0000 [#1] PREEMPT SMP PTICPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1RSP: 0000:ffffac20c5857838 EFLAGS: 00010202RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001cR13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001cFS:  00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace:... ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_map_locked+0x224/0x3a0 [nouveau]Adding any sort of useful debug usually makes it go away, so I handwrote the function in a line, and debugged the asm.Every so often pt->memory->ptrs is NULL. This ptrs ptr is set inthe nv50_instobj_acquire called from nvkm_kmap.If Thread A and Thread B both get to nv50_instobj_acquire aroundthe same time, and Thread A hits the refcount_set line, and inlockstep thread B succeeds at refcount_inc_not_zero, there is achance the ptrs value won't have been stored since refcount_setis unordered. Force a memory barrier here, I picked smp_mb, sincewe want it on all CPUs and it's write followed by a read.v2: use paired smp_rmb/smp_wmb.
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
In the Linux kernel, the following vulnerability has been resolved:wifi: wfx: fix memory leak when starting APKmemleak reported this error:    unreferenced object 0xd73d1180 (size 184):      comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s)      hex dump (first 32 bytes):        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................        00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00  ................      backtrace:        [<5ca11420>] kmem_cache_alloc+0x20c/0x5ac        [<127bdd74>] __alloc_skb+0x144/0x170        [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180        [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]        [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]        [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]        [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]        [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]        [<47bd8b68>] genl_rcv_msg+0x198/0x378        [<453ef796>] netlink_rcv_skb+0xd0/0x130        [<6b7c977a>] genl_rcv+0x34/0x44        [<66b2d04d>] netlink_unicast+0x1b4/0x258        [<f965b9b6>] netlink_sendmsg+0x1e8/0x428        [<aadb8231>] ____sys_sendmsg+0x1e0/0x274        [<d2b5212d>] ___sys_sendmsg+0x80/0xb4        [<69954f45>] __sys_sendmsg+0x64/0xa8    unreferenced object 0xce087000 (size 1024):      comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s)      hex dump (first 32 bytes):        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................        10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............      backtrace:        [<9a993714>] __kmalloc_track_caller+0x230/0x600        [<f83ea192>] kmalloc_reserve.constprop.0+0x30/0x74        [<a2c61343>] __alloc_skb+0xa0/0x170        [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180        [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]        [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]        [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]        [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]        [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]        [<47bd8b68>] genl_rcv_msg+0x198/0x378        [<453ef796>] netlink_rcv_skb+0xd0/0x130        [<6b7c977a>] genl_rcv+0x34/0x44        [<66b2d04d>] netlink_unicast+0x1b4/0x258        [<f965b9b6>] netlink_sendmsg+0x1e8/0x428        [<aadb8231>] ____sys_sendmsg+0x1e0/0x274        [<d2b5212d>] ___sys_sendmsg+0x80/0xb4However, since the kernel is build optimized, it seems the stack is notaccurate. It appears the issue is related to wfx_set_mfp_ap(). The issueis obvious in this function: memory allocated by ieee80211_beacon_get()is never released. Fixing this leak makes kmemleak happy.
Weakness: CWE-125 Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved:clk: qcom: gcc-ipq6018: fix terminating of frequency table arraysThe frequency table arrays are supposed to be terminated with anempty element. Add such entry to the end of the arrays where itis missing in order to avoid possible out-of-bound access whenthe table is traversed by functions like qcom_find_freq() orqcom_find_freq_floor().Only compile tested.
Weakness: CWE-125 Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved:ASoC: SOF: Add some bounds checking to firmware dataSmatch complains about "head->full_size - head->header_size" canunderflow.  To some extent, we're always going to have to trust thefirmware a bit.  However, it's easy enough to add a check for negatives,and let's add a upper bounds check as well.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit v.7.00.6700 and before allows a local attacker to escalate privileges via the DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages components.
Weakness: CWE-1286 Improper Validation of Syntactic Correctness of Input
An issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter.
Weakness: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
In the Linux kernel, the following vulnerability has been resolved:crypto: iaa - Fix nr_cpus < nr_iaa caseIf nr_cpus < nr_iaa, the calculated cpus_per_iaa will be 0, whichcauses a divide-by-0 in rebalance_wq_table().Make sure cpus_per_iaa is 1 in that case, and also in the nr_iaa == 0case, even though cpus_per_iaa is never used if nr_iaa == 0, forparanoia.
Weakness: CWE-369 Divide By Zero
swftools v0.9.2 was discovered to contain a segmentation violation via the function compileSWFActionCode at swftools/lib/action/actioncompiler.c.
Weakness: CWE-125 Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved:usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()When unregister pd capabilitie in tcpm, KASAN will capture below double-free issue. The root cause is the same capabilitiy will be kfreed twice,the first time is kfreed by pd_capabilities_release() and the second timeis explicitly kfreed by tcpm_port_unregister_pd().[    3.988059] BUG: KASAN: double-free in tcpm_port_unregister_pd+0x1a4/0x3dc[    3.995001] Free of addr ffff0008164d3000 by task kworker/u16:0/10[    4.001206][    4.002712] CPU: 2 PID: 10 Comm: kworker/u16:0 Not tainted 6.8.0-rc5-next-20240220-05616-g52728c567a55 #53[    4.012402] Hardware name: Freescale i.MX8QXP MEK (DT)[    4.017569] Workqueue: events_unbound deferred_probe_work_func[    4.023456] Call trace:[    4.025920]  dump_backtrace+0x94/0xec[    4.029629]  show_stack+0x18/0x24[    4.032974]  dump_stack_lvl+0x78/0x90[    4.036675]  print_report+0xfc/0x5c0[    4.040289]  kasan_report_invalid_free+0xa0/0xc0[    4.044937]  __kasan_slab_free+0x124/0x154[    4.049072]  kfree+0xb4/0x1e8[    4.052069]  tcpm_port_unregister_pd+0x1a4/0x3dc[    4.056725]  tcpm_register_port+0x1dd0/0x2558[    4.061121]  tcpci_register_port+0x420/0x71c[    4.065430]  tcpci_probe+0x118/0x2e0To fix the issue, this will remove kree() from tcpm_port_unregister_pd().
Weakness: CWE-415 Double Free
In the Linux kernel, the following vulnerability has been resolved:aoe: fix the potential use-after-free problem in aoecmd_cfg_pktsThis patch is against CVE-2023-6270. The description of cve is:  A flaw was found in the ATA over Ethernet (AoE) driver in the Linux  kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on  `struct net_device`, and a use-after-free can be triggered by racing  between the free on the struct and the access through the `skbtxq`  global queue. This could lead to a denial of service condition or  potential code execution.In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initialcode is finished. But the net_device ifp will still be used inlater tx()->dev_queue_xmit() in kthread. Which means that thedev_put(ifp) should NOT be called in the success path of skbinitial code in aoecmd_cfg_pkts(). Otherwise tx() may run intouse-after-free because the net_device is freed.This patch removed the dev_put(ifp) in the success path inaoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().
Weakness: CWE-416 Use After Free
In the Linux kernel, the following vulnerability has been resolved:netfilter: nft_set_pipapo: do not free live elementPablo reports a crash with large batches of elements with aback-to-back add/remove pattern.  Quoting Pablo:  add_elem("00000000") timeout 100 ms  ...  add_elem("0000000X") timeout 100 ms  del_elem("0000000X") <---------------- delete one that was just added  ...  add_elem("00005000") timeout 100 ms  1) nft_pipapo_remove() removes element 0000000X  Then, KASAN shows a splat.Looking at the remove function there is a chance that we will drop arule that maps to a non-deactivated element.Removal happens in two steps, first we do a lookup for key k and return theto-be-removed element and mark it as inactive in the next generation.Then, in a second step, the element gets removed from the set/map.The _remove function does not work correctly if we have more than oneelement that share the same key.This can happen if we insert an element into a set when the set alreadyholds an element with same key, but the element mapping to the existingkey has timed out or is not active in the next generation.In such case its possible that removal will unmap the wrong element.If this happens, we will leak the non-deactivated element, it becomesunreachable.The element that got deactivated (and will be freed later) willremain reachable in the set data structure, this can result ina crash when such an element is retrieved during lookup (stalepointer).Add a check that the fully matching key does in fact map to the elementthat we have marked as inactive in the deactivation step.If not, we need to continue searching.Add a bug/warn trap at the end of the function as well, the removefunction must not ever be called with an invisible/unreachable/non-existentelement.v2: avoid uneeded temporary variable (Stefano)
Weakness: CWE-476 NULL Pointer Dereference
HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML code via creation of crafted note.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet.
Weakness: CWE-476 NULL Pointer Dereference
An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix potencial out-of-bounds when buffer offset is invalidI found potencial out-of-bounds when buffer offset fields of a few requestsis invalid. This patch set the minimum value of buffer offset field to->Buffer offset to validate buffer length.
Weakness: CWE-125 Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved:lan966x: Fix crash when adding interface under a lagThere is a crash when adding one of the lan966x interfaces under a laginterface. The issue can be reproduced like this:ip link add name bond0 type bond miimon 100 mode balance-xorip link set dev eth0 master bond0The reason is because when adding a interface under the lag it would gothrough all the ports and try to figure out which other ports are underthat lag interface. And the issue is that lan966x can have ports that areNULL pointer as they are not probed. So then iterating over these portsit would just crash as they are NULL pointers.The fix consists in actually checking for NULL pointers before accessingsomething from the ports. Like we do in other places.
Weakness: CWE-400 Uncontrolled Resource Consumption
In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Prevent potential buffer overflow in map_hw_resourcesAdds a check in the map_hw_resources function to prevent a potentialbuffer overflow. The function was accessing arrays using an index thatcould potentially be greater than the size of the arrays, leading to abuffer overflow.Adds a check to ensure that the index is within the bounds of thearrays. If the index is out of bounds, an error message is printed andbreak it will continue execution with just ignoring extra data early toprevent the buffer overflow.Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
An issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receiving DataWriter's data.
Weakness: CWE-400 Uncontrolled Resource Consumption
Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.[1]  https://github.com/apache/inlong/pull/9673 
Weakness: CWE-502 Deserialization of Untrusted Data
There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. 
Weakness: CWE-121 Stack-based Buffer Overflow
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. 
Weakness: CWE-121 Stack-based Buffer Overflow
In the Linux kernel, the following vulnerability has been resolved:serial: max310x: fix NULL pointer dereference in I2C instantiationWhen trying to instantiate a max14830 device from userspace:    echo max14830 0x60 > /sys/bus/i2c/devices/i2c-2/new_devicewe get the following error:    Unable to handle kernel NULL pointer dereference at virtual address...    ...    Call trace:        max310x_i2c_probe+0x48/0x170 [max310x]        i2c_device_probe+0x150/0x2a0    ...Add check for validity of devtype to prevent the error, and abort probewith a meaningful error message.
Weakness: CWE-476 NULL Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:net: phy: qcom: at803x: fix kernel panic with at8031_probeOn reworking and splitting the at803x driver, in splitting function ofat803x PHYs it was added a NULL dereference bug where priv is referencedbefore it's actually allocated and then is tried to write to for theis_1000basex and is_fiber variables in the case of at8031, writing onthe wrong address.Fix this by correctly setting priv local variable only afterat803x_probe is called and actually allocates priv in the phydev struct.
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user.
Weakness: CWE-269 Improper Privilege Management
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary.
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Buffer Overflow vulnerability in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v.3.2 allows a local attacker to execute arbitrary code via the vpn_client_ip variable of the config_vpn_pptp function in rc program.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component.
Weakness: CWE-922 Insecure Storage of Sensitive Information
An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can access the PDNU REST APIs, which may result in compromise of the application.
Weakness: CWE-306 Missing Authentication for Critical Function
TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in WDS Settings under the Wireless Page.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')