Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47640 State: PUBLISHED Published: 2024-10-29T13:10:18.991Z Last Updated: 2024-10-29T13:54:43.678Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: weDevs Products: WP ERP Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in weDevs WP ERP allows Reflected XSS.This issue affects WP ERP: from n/a through 1.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/erp/wordpress-wp-erp-plugin-1-13-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47641 State: PUBLISHED Published: 2024-09-30T12:21:00.384Z Last Updated: 2024-09-30T13:07:44.861Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPDeveloperr Products: Confetti Fall Animation Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloperr Confetti Fall Animation allows Stored XSS.This issue affects Confetti Fall Animation: from n/a through 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/confetti-fall-animation/wordpress-confetti-fall-animation-plugin-1-3-0-cross-s
s://patchstack.com/database/vulnerability/confetti-fall-animation/wordpress-confetti-fall-animation-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47642 State: PUBLISHED Published: 2024-10-05T12:59:49.651Z Last Updated: 2024-10-07T13:21:25.307Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Keap Products: Keap Official Opt-in Forms Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/infusionsoft-official-opt-in-forms/wordpress-keap-official-opt-in-forms-plugin-2-0-1-
chstack.com/database/vulnerability/infusionsoft-official-opt-in-forms/wordpress-keap-official-opt-in-forms-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47643 State: PUBLISHED Published: 2024-10-05T12:56:48.641Z Last Updated: 2024-10-07T14:09:39.599Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Alexander Böhm Products: Include Fussball.de Widgets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Alexander Böhm Include Fussball.De Widgets allows Stored XSS.This issue affects Include Fussball.De Widgets: from n/a through 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/include-fussball-de-widgets/wordpress-include-fussball-de-widg
ferences: - https://patchstack.com/database/vulnerability/include-fussball-de-widgets/wordpress-include-fussball-de-widgets-plugin-4-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47644 State: PUBLISHED Published: 2024-10-05T12:55:38.749Z Last Updated: 2024-10-07T14:11:22.208Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Copyscape / Indigo Stream Technologies Products: Copyscape Premium Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Copyscape / Indigo Stream Technologies Copyscape Premium allows Stored XSS.This issue affects Copyscape Premium: from n/a through 1.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/copyscape-premium/wordpress-copyscape-premium-plugin-1-3-6-csrf-to-stored-cross-site-scripting-vulnerab
se/vulnerability/copyscape-premium/wordpress-copyscape-premium-plugin-1-3-6-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2024-47645 State: PUBLISHED Published: 2024-10-16T13:35:10.142Z Last Updated: 2024-10-16T15:29:14.545Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sajid Javed Products: Top Bar – PopUps – by WPOptin Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sajid Javed Top Bar – PopUps – by WPOptin allows PHP Local File Inclusion.This issue affects Top Bar – PopUps – by WPOptin: from n/a through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpoptin/wordpress-wpoptin-plugin-2-0-1-local-file-inclusion-vul
erences: - https://patchstack.com/database/vulnerability/wpoptin/wordpress-wpoptin-plugin-2-0-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-47646 State: PUBLISHED Published: 2024-10-05T12:53:34.323Z Last Updated: 2024-10-07T14:13:15.465Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Payflex Products: Payflex Payment Gateway Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payflex Payflex Payment Gateway.This issue affects Payflex Payment Gateway: from n/a through 2.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/payflex-payment-gateway/wordpress-payflex-payment-gateway-plugin-2-6-1-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2024-47647 State: PUBLISHED Published: 2024-10-05T12:49:05.601Z Last Updated: 2024-10-28T13:08:29.255Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: HelpieWP Products: Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HelpieWP Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin allows Stored XSS.This issue affects Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin: from n/a through 1.27. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulne
n/a through 1.27. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/helpie-faq/wordpress-faq-accordion-docs-helpie-wordpress-faq-accordion-plugin-plugin-1-27-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47648 State: PUBLISHED Published: 2024-10-10T18:06:33.107Z Last Updated: 2024-10-10T18:44:17.391Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: EventPrime Events Products: EventPrime Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in EventPrime Events EventPrime.This issue affects EventPrime: from n/a through 4.0.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-4-0-4-5-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2024-47649 State: PUBLISHED Published: 2024-10-16T13:08:58.897Z Last Updated: 2024-10-16T13:49:37.764Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: THATplugin Products: Iconize Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize.This issue affects Iconize: from n/a through 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/iconize/wordpress-iconize-plugin-1-2-4-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2024-47650 State: PUBLISHED Published: 2024-10-06T12:53:29.671Z Last Updated: 2024-10-07T13:06:46.948Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Axton Products: WP-WebAuthn Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axton WP-WebAuthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through 1.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-webauthn/wordpress-wp-webauthn-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-47651 State: PUBLISHED Published: 2024-10-04T12:07:45.980Z Last Updated: 2024-10-04T14:12:59.399Z Vendors: Shilpi Computers Products: Client Dashboard Problem Types: CWE-235 Description: This vulnerability exists in Shilpi Client Dashboard due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this vulnerability by including multiple “userid” parameters in the API request body leading to unauthorized access of sensitive information belonging to other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313
CVE ID: CVE-2024-47652 State: PUBLISHED Published: 2024-10-04T12:13:22.614Z Last Updated: 2024-10-04T14:12:13.841Z Vendors: Shilpi Computers Products: Client Dashboard Problem Types: CWE-308 Description: This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted with just their corresponding mobile number. A remote attacker could exploit this vulnerability by providing mobile number of targeted user, to obtain complete access to the targeted user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBV
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313
CVE ID: CVE-2024-47653 State: PUBLISHED Published: 2024-10-04T12:15:44.442Z Last Updated: 2024-10-04T14:11:03.202Z Vendors: Shilpi Computers Products: Client Dashboard Problem Types: CWE-266 Description: This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An authenticated remote attacker could exploit this vulnerability by placing or cancelling requests through API request body leading to unauthorized modification of requests belonging to the other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CI
st Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313
CVE ID: CVE-2024-47654 State: PUBLISHED Published: 2024-10-04T12:18:18.257Z Last Updated: 2024-10-04T14:10:32.719Z Vendors: Shilpi Computers Products: Client Dashboard Problem Types: CWE-799 Description: This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints, which could lead to the OTP bombing on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313
CVE ID: CVE-2024-47655 State: PUBLISHED Published: 2024-10-04T12:21:07.405Z Last Updated: 2024-10-04T13:40:16.465Z Vendors: Shilpi Computers Products: Client Dashboard Problem Types: CWE-434 Description: This vulnerability exists in the Shilpi Client Dashboard due to improper validation of files being uploaded other than the specified extension. An authenticated remote attacker could exploit this vulnerability by uploading malicious file, which could lead to remote code execution on targeted application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313
CVE ID: CVE-2024-47656 State: PUBLISHED Published: 2024-10-04T12:24:27.872Z Last Updated: 2024-10-04T13:38:38.800Z Vendors: Shilpi Computers Products: Client Dashboard Problem Types: CWE-307 Description: This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on password, which could lead to gain unauthorized access to other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313
CVE ID: CVE-2024-47657 State: PUBLISHED Published: 2024-10-04T12:30:46.271Z Last Updated: 2024-10-04T13:34:28.648Z Vendors: Shilpi Computers Products: Net Back Office Problem Types: CWE-639 Description: This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter dfclientid through API request URLs which could lead to unauthorized access to sensitive information belonging to other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313
CVE ID: CVE-2024-47658 State: PUBLISHED Published: 2024-10-09T14:02:53.230Z Last Updated: 2025-05-04T09:36:33.442Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: stm32/cryp - call finalize with bh disabled The finalize operation in interrupt mode produce a produces a spinlock recursion warning. The reason is the fact that BH must be disabled during this process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d93a2f86b0a998aa1f0870c85a2a60a0771ef89a - https://git.kernel.org/stable/c/5d734665cd5d93270731e0ff1dd673fec677f447 - https://git.kernel.org/stable/c/56ddb9aa3b324c2
tps://git.kernel.org/stable/c/5d734665cd5d93270731e0ff1dd673fec677f447 - https://git.kernel.org/stable/c/56ddb9aa3b324c2d9645b5a7343e46010cf3f6ce
CVE ID: CVE-2024-47659 State: PUBLISHED Published: 2024-10-09T14:02:54.070Z Last Updated: 2025-11-03T22:20:23.105Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1) returned packets are incorrectly labeled ('foo' instead of 'bar') 2) 'bar' can write to 'foo' without being authorized to write. Here is a scenario how to see this: * Take two machines, let's call them C and S, with active Smack in the default st
e. Here is a scenario how to see this: * Take two machines, let's call them C and S, with active Smack in the default state (no settings, no rules, no labeled hosts, only builtin labels) * At S, add Smack rule 'foo bar w' (labels 'foo' and 'bar' are instantiated at S at this moment) * At S, at label 'bar', launch a program that listens for incoming tcp/ipv4 connections * From C, at label 'foo', connect to the listener at S. (label 'foo' is instantiated at C at this moment) Connection succeedes and works. * Send some data in both directions. * Collect network traffic of this connection. All packets in both directions are labeled with the CIPSO of the label 'foo'. Hence, label 'bar' writes to
connection. All packets in both directions are labeled with the CIPSO of the label 'foo'. Hence, label 'bar' writes to 'foo' without being authorized, and even without ever being known at C. If anybody cares: exactly the same happens with DCCP. This behavior 1st manifested in release 2.6.29.4 (see Fixes below) and it looks unintentional. At least, no explanation was provided. I changed returned packes label into the 'bar', to bring it into line with the Smack documentation claims. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8 - https://git.kernel.org/stable/c/5b4b304f196c0703
ps://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8 - https://git.kernel.org/stable/c/5b4b304f196c070342e32a4752e1fa2e22fc0671 - https://git.kernel.org/stable/c/a948ec993541db4ef392b555c37a1186f4d61670 - https://git.kernel.org/stable/c/0aea09e82eafa50a373fc8a4b84c1d4734751e2c - https://git.kernel.org/stable/c/0776bcf9cb6de46fdd94d10118de1cf9b05f83b9 - https://git.kernel.org/stable/c/4be9fd15c3c88775bdf6fa37acabe6de85beebff - https://git.kernel.org/stable/c/d3703fa94116fed91f64c7d1c7d284fb4369070f - https://git.kernel.org/stable/c/2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550
CVE ID: CVE-2024-47660 State: PUBLISHED Published: 2024-10-09T14:02:54.884Z Last Updated: 2025-11-03T22:20:24.577Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENT_WATCHED flags lazily In some setups directories can have many (usually negative) dentries. Hence __fsnotify_update_child_dentry_flags() function can take a significant amount of time. Since the bulk of this function happens under inode->i_lock this causes a significant contention on the lock when we remove the watch from the directory as the __fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask() races with __fsnotify_update_child
ectory as the __fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask() races with __fsnotify_update_child_dentry_flags() calls from __fsnotify_parent() happening on children. This can lead upto softlockup reports reported by users. Fix the problem by calling fsnotify_update_children_dentry_flags() to set PARENT_WATCHED flags only when parent starts watching children. When parent stops watching children, clear false positive PARENT_WATCHED flags lazily in __fsnotify_parent() for each accessed child. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3f3ef1d9f66b93913ce2171120d9226b55acd41d - https://git.kern
ram Container: References: - https://git.kernel.org/stable/c/3f3ef1d9f66b93913ce2171120d9226b55acd41d - https://git.kernel.org/stable/c/f9a48bc3dd9099935751458a5bbbea4b7c28abc8 - https://git.kernel.org/stable/c/d8c42405fc3507cc43ba7e4986a773c3fc633f6e - https://git.kernel.org/stable/c/fc1b1e135c3f72382f792e6c319fc088d5523ad5 - https://git.kernel.org/stable/c/7ef1d2e240c32b1f337a37232d037b07e3919e1a - https://git.kernel.org/stable/c/172e422ffea20a89bfdc672741c1aad6fbb5044e
CVE ID: CVE-2024-47661 State: PUBLISHED Published: 2024-10-09T14:05:25.571Z Last Updated: 2025-07-11T17:20:47.365Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid overflow from uint32_t to uint8_t [WHAT & HOW] dmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned 0xFFFF. Fix it by changing it to uint8_t with value of 0xFF. This fixes 2 INTEGER_OVERFLOW issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/30d1b783b6eeaf49d311a072c70d618d993d01ec - https://git.kernel.org/stable/c/d6b54900c564e35989cf6813e4071504fa0a90e0
CVE ID: CVE-2024-47662 State: PUBLISHED Published: 2024-10-09T14:05:26.334Z Last Updated: 2025-07-28T11:16:39.724Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection [Why] These registers should not be read from driver and triggering the security violation when DMCUB work times out and diagnostics are collected blocks Z8 entry. [How] Remove the register read from DCN35. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/eba4b2a38ccdf074a053834509545703d6df1d57 - https://git.kernel.org/stable/c/466423c6dd8af23ebb3a69
it.kernel.org/stable/c/eba4b2a38ccdf074a053834509545703d6df1d57 - https://git.kernel.org/stable/c/466423c6dd8af23ebb3a69d43434d01aed0db356
CVE ID: CVE-2024-47663 State: PUBLISHED Published: 2024-10-09T14:13:56.514Z Last Updated: 2025-11-03T22:20:26.126Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: iio: frequency: ad9834: Validate frequency parameter value In ad9834_write_frequency() clk_get_rate() can return 0. In such case ad9834_calc_freqreg() call will lead to division by zero. Checking 'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0. ad9834_write_frequency() is called from ad9834_write(), where fout is taken from text buffer, which can contain any value. Modify parameters checking. Found by Linux Verification Center (linuxtesting
m text buffer, which can contain any value. Modify parameters checking. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5edc3a45ef428501000a7b23d0e1777a548907f6 - https://git.kernel.org/stable/c/0e727707a239d5c519fc9abc2f0fd913516a7e47 - https://git.kernel.org/stable/c/41cc91e3138fe52f8da92a81bebcd0e6cf488c53 - https://git.kernel.org/stable/c/d8b09a5edc4a634373158c1a405491de3c52e58a - https://git.kernel.org/stable/c/3ba9abfcaa9e16bb91ed7e0e2b42e94a157a953e - https://git.kernel.org/stable/c/dc12e49f970b08d8b007b8981b97e2eb93c0e89d - https://git.kernel.org
7e0e2b42e94a157a953e - https://git.kernel.org/stable/c/dc12e49f970b08d8b007b8981b97e2eb93c0e89d - https://git.kernel.org/stable/c/8961b245e8f92bccbaacfbbdf69eba60e3e7c227 - https://git.kernel.org/stable/c/b48aa991758999d4e8f9296c5bbe388f293ef465
CVE ID: CVE-2024-47664 State: PUBLISHED Published: 2024-10-09T14:13:57.337Z Last Updated: 2025-05-04T09:36:42.722Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware If the value of max_speed_hz is 0, it may cause a division by zero error in hisi_calc_effective_speed(). The value of max_speed_hz is provided by firmware. Firmware is generally considered as a trusted domain. However, as division by zero errors can cause system failure, for defense measure, the value of max_speed is validated here. So 0 is regarded as invalid and an error code is return
, for defense measure, the value of max_speed is validated here. So 0 is regarded as invalid and an error code is returned. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/16ccaf581da4fcf1e4d66086cf37263f9a656d43 - https://git.kernel.org/stable/c/ee73a15d4a8ce8fb02d7866f7cf78fcdd16f0fcc - https://git.kernel.org/stable/c/5127c42c77de18651aa9e8e0a3ced190103b449c
CVE ID: CVE-2024-47665 State: PUBLISHED Published: 2024-10-09T14:13:58.061Z Last Updated: 2025-11-03T22:20:30.277Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup Definitely condition dma_get_cache_alignment * defined value > 256 during driver initialization is not reason to BUG_ON(). Turn that to graceful error out with -EINVAL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cacb76df247a7cd842ff29755a523b1cba6c0508 - https://git.kernel.org/stable/c/2666085335bdfedf90d91f4071490ad3980be785
e/c/cacb76df247a7cd842ff29755a523b1cba6c0508 - https://git.kernel.org/stable/c/2666085335bdfedf90d91f4071490ad3980be785 - https://git.kernel.org/stable/c/5a022269abb22809f2a174b90f200fc4b9526058 - https://git.kernel.org/stable/c/e2d14bfda9eb5393f8a17008afe2aa7fe0a29815 - https://git.kernel.org/stable/c/8a2be2f1db268ec735419e53ef04ca039fc027dc