Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-39417 State: PUBLISHED Published: 2024-08-14T11:57:17.890Z Last Updated: 2024-08-14T14:13:22.932Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-285 Description: Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://he
CVE ID: CVE-2024-39418 State: PUBLISHED Published: 2024-08-14T11:57:20.916Z Last Updated: 2024-09-17T11:07:31.253Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-285 Description: Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References
loitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-61.html
CVE ID: CVE-2024-39419 State: PUBLISHED Published: 2024-08-14T11:57:22.405Z Last Updated: 2024-08-14T14:12:33.337Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-285 Description: Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help
CVE ID: CVE-2024-39420 State: PUBLISHED Published: 2024-08-14T15:07:28.784Z Last Updated: 2024-09-16T12:30:11.437Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-367 Description: Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an atta
ctions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-70.html
CVE ID: CVE-2024-39422 State: PUBLISHED Published: 2024-08-14T15:07:31.068Z Last Updated: 2024-08-15T03:55:53.237Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-416 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb2
CVE ID: CVE-2024-39423 State: PUBLISHED Published: 2024-08-14T15:07:29.540Z Last Updated: 2024-08-15T03:55:54.569Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-787 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat
file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
CVE ID: CVE-2024-39424 State: PUBLISHED Published: 2024-08-14T15:07:26.473Z Last Updated: 2024-08-15T03:55:55.776Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-416 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb2
CVE ID: CVE-2024-39425 State: PUBLISHED Published: 2024-08-14T15:07:23.644Z Last Updated: 2024-08-15T03:55:56.990Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-367 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acr
is high. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
CVE ID: CVE-2024-39426 State: PUBLISHED Published: 2024-08-14T15:07:32.157Z Last Updated: 2024-08-15T03:55:58.149Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious
ontext of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
CVE ID: CVE-2024-39427 State: PUBLISHED Published: 2024-07-01T08:40:56.972Z Last Updated: 2024-08-02T04:26:14.285Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-787 Out-of-bounds Write Description: In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.unisoc.com/en_us/secy/announcementDetail/18075
CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1807576926177525762
CVE ID: CVE-2024-39428 State: PUBLISHED Published: 2024-07-01T08:40:57.909Z Last Updated: 2024-08-02T04:26:15.425Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-787 Out-of-bounds Write Description: In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.unisoc.com/en_us/secy/announcementDetail/18075
CVE ID: CVE-2024-39429 State: PUBLISHED Published: 2024-07-01T08:40:58.938Z Last Updated: 2024-08-02T04:26:14.276Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618 Problem Types: cwe-787 Out-of-bounds Write Description: In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1807576926177525762
CVE ID: CVE-2024-39430 State: PUBLISHED Published: 2024-07-01T08:40:59.852Z Last Updated: 2024-08-19T16:50:43.247Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618 Problem Types: cwe-787 Out-of-bounds Write Description: In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1807576926177525762
CVE ID: CVE-2024-39431 State: PUBLISHED Published: 2024-09-27T07:37:40.908Z Last Updated: 2024-09-27T15:42:50.544Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-121 Stack-based Buffer Overflow Description: In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1830802995705610241
CVE ID: CVE-2024-39432 State: PUBLISHED Published: 2024-09-27T07:37:41.899Z Last Updated: 2024-09-27T15:40:31.593Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-121 Stack-based Buffer Overflow Description: In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1830802995705610241
CVE ID: CVE-2024-39433 State: PUBLISHED Published: 2024-09-27T07:37:42.872Z Last Updated: 2024-09-27T15:37:17.832Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-787 Out-of-bounds Write Description: In drm service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1830802995705610241
CVE ID: CVE-2024-39434 State: PUBLISHED Published: 2024-09-27T07:37:43.831Z Last Updated: 2024-09-27T15:36:16.117Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-125 Out-of-bounds Read Description: In drm service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1830802995705610241
CVE ID: CVE-2024-39435 State: PUBLISHED Published: 2024-09-27T07:37:44.941Z Last Updated: 2024-09-27T15:34:57.072Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: In Logmanager service, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.uni
additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1830802995705610241
CVE ID: CVE-2024-39436 State: PUBLISHED Published: 2024-10-09T06:43:27.037Z Last Updated: 2024-10-09T21:53:14.786Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
privilege with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1843898270204624897
CVE ID: CVE-2024-39437 State: PUBLISHED Published: 2024-10-09T06:43:28.078Z Last Updated: 2024-10-09T21:55:01.418Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
CVE ID: CVE-2024-39438 State: PUBLISHED Published: 2024-10-09T06:43:29.015Z Last Updated: 2024-10-09T18:52:15.994Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
CVE ID: CVE-2024-39439 State: PUBLISHED Published: 2024-10-09T06:43:29.967Z Last Updated: 2024-10-09T18:54:01.471Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-787 Out-of-bounds Write Description: In DRM service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1843898270204624897
CVE ID: CVE-2024-39440 State: PUBLISHED Published: 2024-10-09T06:43:30.948Z Last Updated: 2024-10-09T17:53:26.151Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T606/T612/T616/T610/T618/T760/T770/T820/S8000 Problem Types: cwe-476 NULL Pointer Dereference Description: In DRM service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with System execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1843898270204624897
CVE ID: CVE-2024-39441 State: PUBLISHED Published: 2025-02-26T05:45:36.102Z Last Updated: 2025-02-26T15:34:21.609Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000 Problem Types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Description: In wifi display, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1894203086612791298
CVE ID: CVE-2024-39442 State: PUBLISHED Published: 2025-05-06T01:07:27.196Z Last Updated: 2025-05-06T02:40:53.626Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300 Problem Types: cwe-862 Missing Authorization Description: In sprd ssense service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1919552952486
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1919552952486395905
CVE ID: CVE-2024-39457 State: PUBLISHED Published: 2024-07-19T08:36:27.786Z Last Updated: 2025-03-19T20:42:34.492Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Cross-site scripting (XSS) Description: Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cybozu.support/?product=garoon&v=&fv=6.0.2&t=%E8%84%86%E5%BC%B1%E6%80%A7&f=&r=&b=&s=&posts_per_page=20 - https://jvn.jp/en/jp/JVN74825766/
CVE ID: CVE-2024-39458 State: PUBLISHED Published: 2024-06-26T17:06:26.399Z Last Updated: 2025-02-13T17:53:16.696Z Vendors: Jenkins Project Products: Jenkins Structs Plugin Description: When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secrets through the default system log. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3371 - http://www.openwall.com/lists/oss-security/2024/06/26/2
CVE ID: CVE-2024-39459 State: PUBLISHED Published: 2024-06-26T17:06:27.043Z Last Updated: 2025-02-13T17:53:17.283Z Vendors: Jenkins Project Products: Jenkins Plain Credentials Plugin Description: In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-06-26/#SECUR
CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495 - http://www.openwall.com/lists/oss-security/2024/06/26/2
CVE ID: CVE-2024-39460 State: PUBLISHED Published: 2024-06-26T17:06:27.695Z Last Updated: 2025-02-13T17:53:17.942Z Vendors: Jenkins Project Products: Jenkins Bitbucket Branch Source Plugin Description: Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3363 - http://www.openwall.com/lists/oss-security/2024/06/26/2
CVE ID: CVE-2024-39461 State: PUBLISHED Published: 2024-06-25T14:25:01.453Z Last Updated: 2025-05-04T09:16:18.680Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer about the number of elements in hws, so that it can warn when hws is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens,
t change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in raspberrypi_discover_clocks() due to ->num being assigned after ->hws has been accessed: UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-raspberrypi.c:374:4 index 3 is out of range for type 'struct clk_hw *[] __counted_by(num)' (aka 'struct clk_hw *[]') Move the ->num initialization to before the first access of ->hws, which clears up the warning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ws, which clears up the warning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9562dbe5cdbb16ac887d27ef6f179980bb99193c - https://git.kernel.org/stable/c/cdf9c7871d58d3df59d2775982e3533adb8ec920 - https://git.kernel.org/stable/c/6dc445c1905096b2ed4db1a84570375b4e00cc0f
CVE ID: CVE-2024-39462 State: PUBLISHED Published: 2024-06-25T14:25:02.196Z Last Updated: 2025-05-04T09:16:19.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer about the number of elements in hws, so that it can warn when hws is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens,