Dunateo/VulnDesc_CWE_Mapping huggingface dataset:
An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.The security update addresses the vulnerability by ensuring the psmsrv.dll properly handles objects in memory.
Weakness: CWE-269 Improper Privilege Management
A security feature bypass exists when Windows incorrectly validates CAB file signatures. An attacker who successfully exploited this vulnerability could inject code into a CAB file without invalidating the file's signature.To exploit the vulnerability, an attacker could modify a signed CAB file and inject malicious code. The attacker could then convince a target user to execute the file.The update addresses the vulnerability by correcting how Windows validates file signatures.
Weakness: CWE-354 Improper Validation of Integrity Check Value
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.The security update addresses the vulnerability by ensuring the PsmServiceExtHost.dll properly handles objects in memory.
Weakness: CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the user’s system.To exploit the vulnerability, an attacker could host a specially crafted website designed to invoke MSXML through a web browser. However, an attacker would have no way to force a user to visit such a website. Instead, an attacker would typically have to convince a user to either click a link in an email message or instant message that would then take the user to the website. When Internet Explorer parses the XML content, an attacker could run malicious code remotely to take control of the user’s system.The update addresses the vulnerability by correcting how the MSXML parser processes user input.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs
Weakness: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.The update addresses the vulnerability by correcting the way in which the Windows Graphics Component handles objects in memory.
Weakness: CWE-125 Out-of-bounds Read
D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an untrusted project file
Weakness: CWE-502 Deserialization of Untrusted Data
The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the ui_language POST parameter to the apply.cgi form endpoint. This occurs in do_upgrade_post in mini_httpd. NOTE: This vulnerability only affects products that are no longer supported by the maintaine
Weakness: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner
Weakness: CWE-434 Unrestricted Upload of File with Dangerous Type
Windows AD FS Security Feature Bypass Vulnerability
Weakness: CWE-863 Incorrect Authorization
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Weakness: CWE-863 Incorrect Authorization
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Weakness: CWE-122 Heap-based Buffer Overflow
Windows Kernel Information Disclosure Vulnerability
Weakness: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Windows TCP/IP Driver Security Feature Bypass Vulnerability
Weakness: CWE-639 Authorization Bypass Through User-Controlled Key
Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data.
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure.
Weakness: CWE-20: Improper Input Validation
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability."
Weakness: CWE-121 Stack-based Buffer Overflow
Dnsmasq 2.86 has a heap-based buffer overflow in print_mac (called from log_packet and dhcp_reply). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge.
Weakness: CWE-122 Heap-based Buffer Overflow
TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficient privileges), would visit the page and the server restart would begin. The attacker must know the full URL that TruDesk is on in order to craft the webpage.
Weakness: CWE-352 Cross-Site Request Forgery (CSRF)
Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users
Weakness: CWE-281 Improper Preservation of Permissions
DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.
Weakness: CWE-476 NULL Pointer Dereference
Storage Spaces Controller Elevation of Privilege Vulnerability
Weakness: CWE-190 Integer Overflow or Wraparound
DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Weakness: CWE-287 Improper Authentication
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
Weakness: CWE-416 Use After Free
An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the observed behavior is intended
Weakness: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Uncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Weakness: CWE-248 Uncaught Exception
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised
Weakness: CWE-502: Deserialization of Untrusted Data
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Weakness: CWE-20 Improper Input Validation
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
In the Linux kernel, the following vulnerability has been resolved:net: qrtr: Avoid potential use after free in MHI sendIt is possible that the MHI ul_callback will be invoked immediatelyfollowing the queueing of the skb for transmission, leading to thecallback decrementing the refcount of the associated sk and freeing theskb.As such the dereference of skb and the increment of the sk refcount musthappen before the skb is queued, to avoid the skb to be used after freeand potentially the sk to drop its last refcount..
Weakness: CWE-416 Use After Free
RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard (all versions). Unless mitigated, an adversary could produce source code identifiers using homoglyph characters that render visually identical to but are distinct from a target identifier. In this way, an adversary could inject adversarial identifier definitions in upstream software that are not detected by human reviewers and are invoked deceptively in downstream software. The Unicode Consortium has documented this class of security vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms.
Weakness: CWE-1007 Insufficient Visual Distinction of Homoglyphs Presented to User
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).
Weakness: CWE-345 Insufficient Verification of Data Authenticity
Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
Weakness: CWE-415 Double Free
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".
Weakness: CWE-639 Authorization Bypass Through User-Controlled Key
BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, include Tigera products in some configurations, as well as products of other vendors) may have been susceptible to route redirection for Denial of Service and/or Information Disclosure. NOTE: a researcher has asserted that the behavior is within Tigera’s area of responsibility
Weakness: CWE-306: Missing Authentication for Critical Function
The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user joins the server" feature (or possibly have unspecified other impact) because the uploader web service allows double extensions (such as .html.jpg) with the text/html content type. NOTE: there may not be cases in which an uploader web service is customer controlled
Weakness: CWE-434: Unrestricted Upload of File with Dangerous Type
Windows Setup Elevation of Privilege Vulnerability
Weakness: CWE-59 Improper Link Resolution Before File Access ('Link Following')
In the Linux kernel, the following vulnerability has been resolved:ipack: ipoctal: fix module reference leakA reference to the carrier module was taken on every open but was onlyreleased once when the final reference to the tty struct was dropped.Fix this by taking the module reference and initialising the tty driverdata when installing the tty.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
In the Linux kernel, the following vulnerability has been resolved:mISDN: fix possible use-after-free in HFC_cleanup()This module's remove path calls del_timer(). However, that functiondoes not wait until the timer handler finishes. This means that thetimer handler may still be running after the driver's remove functionhas finished, which would result in a use-after-free.Fix by calling del_timer_sync(), which makes sure the timer handlerhas finished, and unable to re-schedule itself.
Weakness: CWE-416 Use After Free
In the Linux kernel, the following vulnerability has been resolved:can: j1939: fix Use-after-Free, hold skb ref while in useThis patch fixes a Use-after-Free found by the syzbot.The problem is that a skb is taken from the per-session skb queue,without incrementing the ref count. This leads to a Use-after-Free ifthe skb is taken concurrently from the session queue due to a CTS.
Weakness: CWE-416 Use After Free
In the Linux kernel, the following vulnerability has been resolved:mptcp: fix soft lookup in subflow_error_report()Maxim reported a soft lookup in subflow_error_report(): watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [swapper/0:0] RIP: 0010:native_queued_spin_lock_slowpath RSP: 0018:ffffa859c0003bc0 EFLAGS: 00000202 RAX: 0000000000000101 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff9195c2772d88 RSI: 0000000000000000 RDI: ffff9195c2772d88 RBP: ffff9195c2772d00 R08: 00000000000067b0 R09: c6e31da9eb1e44f4 R10: ffff9195ef379700 R11: ffff9195edb50710 R12: ffff9195c2772d88 R13: ffff9195f500e3d0 R14: ffff9195ef379700 R15: ffff9195ef379700 FS:  0000000000000000(0000) GS:ffff91961f400000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c000407000 CR3: 0000000002988000 CR4: 00000000000006f0 Call Trace:  <IRQ> _raw_spin_lock_bh subflow_error_report mptcp_subflow_data_available __mptcp_move_skbs_from_subflow mptcp_data_ready tcp_data_queue tcp_rcv_established tcp_v4_do_rcv tcp_v4_rcv ip_protocol_deliver_rcu ip_local_deliver_finish __netif_receive_skb_one_core netif_receive_skb rtl8139_poll 8139too __napi_poll net_rx_action __do_softirq __irq_exit_rcu common_interrupt  </IRQ>The calling function - mptcp_subflow_data_available() - can be invokedfrom different contexts:- plain ssk socket lock- ssk socket lock + mptcp_data_lock- ssk socket lock + mptcp_data_lock + msk socket lock.Since subflow_error_report() tries to acquire the mptcp_data_lock, thelatter two call chains will cause soft lookup.This change addresses the issue moving the error reporting call toouter functions, where the held locks list is known and the we canacquire only the needed one.
Weakness: CWE-667 Improper Locking
In the Linux kernel, the following vulnerability has been resolved:tracing: Correct the length check which causes memory corruptionWe've suffered from severe kernel crashes due to memory corruption onour production environment, like,Call Trace:[1640542.554277] general protection fault: 0000 [#1] SMP PTI[1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G[1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190[1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286[1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX:0000000006e931bf[1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI:ffff9a45ff004300[1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09:0000000000000000[1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12:ffffffff9a20608d[1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15:696c662f65636976[1640542.563128] FS:  00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000)knlGS:0000000000000000[1640542.563937] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4:00000000003606e0[1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000[1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400[1640542.566742] Call Trace:[1640542.567009]  anon_vma_clone+0x5d/0x170[1640542.567417]  __split_vma+0x91/0x1a0[1640542.567777]  do_munmap+0x2c6/0x320[1640542.568128]  vm_munmap+0x54/0x70[1640542.569990]  __x64_sys_munmap+0x22/0x30[1640542.572005]  do_syscall_64+0x5b/0x1b0[1640542.573724]  entry_SYSCALL_64_after_hwframe+0x44/0xa9[1640542.575642] RIP: 0033:0x7f45d6e61e27James Wang has reproduced it stably on the latest 4.19 LTS.After some debugging, we finally proved that it's due to ftracebuffer out-of-bound access using a debug tool as follows:[   86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000[   86.780806]  no_context+0xdf/0x3c0[   86.784327]  __do_page_fault+0x252/0x470[   86.788367]  do_page_fault+0x32/0x140[   86.792145]  page_fault+0x1e/0x30[   86.795576]  strncpy_from_unsafe+0x66/0xb0[   86.799789]  fetch_memory_string+0x25/0x40[   86.804002]  fetch_deref_string+0x51/0x60[   86.808134]  kprobe_trace_func+0x32d/0x3a0[   86.812347]  kprobe_dispatcher+0x45/0x50[   86.816385]  kprobe_ftrace_handler+0x90/0xf0[   86.820779]  ftrace_ops_assist_func+0xa1/0x140[   86.825340]  0xffffffffc00750bf[   86.828603]  do_sys_open+0x5/0x1f0[   86.832124]  do_syscall_64+0x5b/0x1b0[   86.835900]  entry_SYSCALL_64_after_hwframe+0x44/0xa9commit b220c049d519 ("tracing: Check length before giving outthe filter buffer") adds length check to protect trace dataoverflow introduced in 0fc1b09ff1ff, seems that this fix can't preventoverflow entirely, the length check should also take the sizeofentry->array[0] into account, since this array[0] is filled thelength of trace data and occupy addtional space and risk overflow.
Weakness: CWE-125 Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved:KVM: SVM: fix missing sev_decommission in sev_receive_startDECOMMISSION the current SEV context if binding an ASID fails afterRECEIVE_START.  Per AMD's SEV API, RECEIVE_START generates a new guestcontext and thus needs to be paired with DECOMMISSION:     The RECEIVE_START command is the only command other than the LAUNCH_START     command that generates a new guest context and guest handle.The missing DECOMMISSION can result in subsequent SEV launch failures,as the firmware leaks memory and might not able to allocate more SEVguest contexts in the future.Note, LAUNCH_START suffered the same bug, but was previously fixed bycommit 934002cd660b ("KVM: SVM: Call SEV Guest Decommission if ASIDbinding fails").
Weakness: CWE-772 Missing Release of Resource after Effective Lifetime
In the Linux kernel, the following vulnerability has been resolved:iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get failsarm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases therefcount of the "smmu" even though the return value is less than 0.The reference counting issue happens in some error handling paths ofarm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get()fails, the caller functions forget to decrease the refcount of "smmu"increased by arm_smmu_rpm_get(), causing a refcount leak.Fix this issue by calling pm_runtime_resume_and_get() instead ofpm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcountbalanced in case of failure.
Weakness: CWE-911 Improper Update of Reference Count
In the Linux kernel, the following vulnerability has been resolved:audit: fix possible null-pointer dereference in audit_filter_rulesFix  possible null-pointer dereference in audit_filter_rules.audit_filter_rules() error: we previously assumed 'ctx' could be null
Weakness: CWE-476 NULL Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:NFS: Fix use-after-free in nfs4_init_client()KASAN reports a use-after-free when attempting to mount two differentexports through two different NICs that belong to the same server.Olga was able to hit this with kernels starting somewhere between 5.7and 5.10, but I traced the patch that introduced the clear_bit() call to4.13. So something must have changed in the refcounting of the clppointer to make this call to nfs_put_client() the very last one.
Weakness: CWE-416 Use After Free