Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-36756 State: PUBLISHED Published: 2023-07-12T06:52:34.235Z Last Updated: 2024-10-22T18:52:20.150Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: 10web Products: 10WebAnalytics Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to missing or incorrect nonce validation on the create_csv_file() function. This makes it possible for unauthenticated attackers to create a CSV file via a forged request granted they can trick a site administrator into performing an action such as clicking on a li
file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db29f17d-1d2b-4f78-a78d-1579e2a5d975?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet
3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2371142%40wd-google-analytics&new=2371142%40wd-google-analytics&sfp_email=&sfph_mail=
CVE ID: CVE-2020-36757 State: PUBLISHED Published: 2023-07-12T06:52:35.053Z Last Updated: 2024-10-21T18:11:19.906Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: thimpress Products: WP Hotel Booking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incorrect nonce validation on the admin_add_order_item() function. This makes it possible for unauthenticated attackers to add an order item via a forged request granted they can trick a site administrator into performing an action such as cl
add an order item via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9826d7-f8f5-4d3d-8145-3d4e6a63d784?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://b
bilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2368289%40wp-hotel-booking&new=2368289%40wp-hotel-booking&sfp_email=&sfph_mail=
CVE ID: CVE-2020-36758 State: PUBLISHED Published: 2023-10-20T07:29:36.500Z Last Updated: 2024-09-11T15:55:23.255Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: themeisle Products: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated attackers to update post meta via a forged
feedzy_post_type_meta() function. This makes it possible for unauthenticated attackers to update post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3b916dc-3b94-4319-a805-0ea99d14429f?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.
srf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset/2369394/feedzy-rss-feeds/trunk/includes/admin/feedzy-rss-feeds-admin.php
CVE ID: CVE-2020-36759 State: PUBLISHED Published: 2023-10-20T07:29:36.978Z Last Updated: 2024-09-11T15:54:48.632Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: webcraftic Products: Woody code snippets – Insert Header Footer Code, AdSense Ads Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a sit
ible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e573c0a4-d053-400b-828c-0d0eca880776?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-pl
et.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2368332%40insert-php&new=2368332%40insert-php&sfp_email=&sfph_mail=
CVE ID: CVE-2020-36760 State: PUBLISHED Published: 2023-07-12T07:21:50.591Z Last Updated: 2024-10-17T13:34:31.173Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: oceanwp Products: Ocean Extra Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the add_core_extensions_bundle_validation() function. This makes it possible for unauthenticated attackers to validate extension bundles via a forged request granted they can trick a site administrator into performing an act
rs to validate extension bundles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3ef121-13ea-4e42-90c1-1f4bd31ebbcf?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-
d-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2391055%40ocean-extra&new=2391055%40ocean-extra&sfp_email=&sfph_mail=
CVE ID: CVE-2020-36761 State: PUBLISHED Published: 2023-07-12T07:21:51.472Z Last Updated: 2024-09-27T19:57:07.480Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ajay Products: Top 10 – Popular posts plugin for WordPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Top 10 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing or incorrect nonce validation on the tptn_export_tables() function. This makes it possible for unauthenticated attackers to generate an export of the top 10 table via a forged request granted they can trick a site administrator into
tackers to generate an export of the top 10 table via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0af86e4-c30b-49e2-ad6a-97a415a74d18?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vuln
ress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2368373%40top-10&new=2368373%40top-10&sfp_email=&sfph_mail=
CVE ID: CVE-2020-36762 State: PUBLISHED Published: 2023-07-18T15:00:04.532Z Last Updated: 2024-08-04T17:37:07.266Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ONS Digital Products: RAS Collection Instrument Problem Types: CWE-78 Description: A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os command injection. Upgrading to version 2.0.28 is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to
is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-234248. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.234248 - https://vuldb.com/?ctiid.234248 - https://github.com/ONSdigital/ras-collection-instrument/pull/199 - https://github.com/ONSdigital/ras-collection-instrument/commit/dcaad2540f7d50c512ff2e031d3778dd9337db2b - https://github.com/ONSdigital/ras-collection-instrument/releases/tag/2.0.28
CVE ID: CVE-2020-36763 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T18:53:06.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/annyshow/DuxCMS2.1/issues/I183GG
CVE ID: CVE-2020-36765 State: PUBLISHED Published: 2024-07-16T22:30:25.871Z Last Updated: 2024-11-06T20:06:59.358Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html - https://issues.chromium.org/issues/40091076
CVE ID: CVE-2020-36766 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-09-25T18:00:32.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/6c42227c3467549ddc65efe99c869021d2f4a570 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.6
CVE ID: CVE-2020-36767 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-09-09T19:59:56.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows shell metacharacters in titles, messages, and other input data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/servo/servo/issues/25498#issuecomment-703527082
CVE ID: CVE-2020-36768 State: PUBLISHED Published: 2023-12-03T11:00:04.981Z Last Updated: 2024-08-04T17:37:07.177Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: rl-institut Products: NESP2 Problem Types: CWE-89 Description: A vulnerability was found in rl-institut NESP2 Initial Release/1.0. It has been classified as critical. Affected is an unknown function of the file app/database.py. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 07c0cdf36cf6a4345086d07b54423723a496af5e. It is recommended to apply a patch to fix this issue. VDB-246642 is the identi
07c0cdf36cf6a4345086d07b54423723a496af5e. It is recommended to apply a patch to fix this issue. VDB-246642 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246642 - https://vuldb.com/?ctiid.246642 - https://github.com/rl-institut/NESP2/pull/333 - https://github.com/rl-institut/NESP2/issues/334 - https://github.com/rl-institut/NESP2/commit/07c0cdf36cf6a4345086d07b54423723a496af5e
CVE ID: CVE-2020-36769 State: PUBLISHED Published: 2023-12-23T09:36:04.803Z Last Updated: 2024-08-04T17:37:07.166Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: kevinlangleyjr Products: Widget Settings Importer/Exporter Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber
insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e14f0fc6-fca4-4dd7-8f7b-ed5ed535c9af?source=cve - https://www.wordfence.com/blog/2020/04/unpatched-high-severity-vulnerability-in-widget-settings-importer-exporter-plugin/
CVE ID: CVE-2020-36770 State: PUBLISHED Published: 2024-01-15T00:00:00.000Z Last Updated: 2025-06-20T16:50:24.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.gentoo.org/631552
CVE ID: CVE-2020-36771 State: PUBLISHED Published: 2024-01-22T13:53:35.745Z Last Updated: 2025-06-20T18:33:37.646Z Vendors: Cloudlinux OS Products: cagefs Problem Types: CWE-214 Description: CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations this allows local users to view the authentication token via the process list and gain code execution as another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.cloudlinux.com/cagefs-lve-wrappers-and-bsock-have-been-rolled-out-to-100 - http://seclists.org/fulldisclosure/2024/Jan/24 - http://packetstormsecurity.com/files/176790/C
-been-rolled-out-to-100 - http://seclists.org/fulldisclosure/2024/Jan/24 - http://packetstormsecurity.com/files/176790/CloudLinux-CageFS-7.1.1-1-Token-Disclosure.html - https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-01_CloudLinux_CageFS_Token_Disclosure
CVE ID: CVE-2020-36772 State: PUBLISHED Published: 2024-01-22T14:11:25.325Z Last Updated: 2025-05-30T14:22:56.296Z Vendors: Cloudlinux OS Products: cagefs Problem Types: CWE-73 Description: CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100 - http://seclists.org/fulldisclosure/2024/Jan/25 - http://packetstormsecurity.com/fi
7-cllib-have-been-rolled-out-to-100 - http://seclists.org/fulldisclosure/2024/Jan/25 - http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html - https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands
CVE ID: CVE-2020-36773 State: PUBLISHED Published: 2024-02-04T00:00:00.000Z Last Updated: 2025-05-22T17:29:16.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=702229 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=8c7bd787defa071c96289b7da9397f673fddb874 - https://bugzilla.opensuse.org/show_bug
ipt.com/?p=ghostpdl.git%3Ba=commit%3Bh=8c7bd787defa071c96289b7da9397f673fddb874 - https://bugzilla.opensuse.org/show_bug.cgi?id=1177922 - https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs9530
CVE ID: CVE-2020-36774 State: PUBLISHED Published: 2024-02-19T00:00:00 Last Updated: 2024-09-04T14:43:46.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/glade/-/issues/479 - https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17
CVE ID: CVE-2020-36775 State: PUBLISHED Published: 2024-02-26T17:20:21.486Z Last Updated: 2025-07-11T17:18:57.084Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock Using f2fs_trylock_op() in f2fs_write_compressed_pages() to avoid potential deadlock like we did in f2fs_write_single_data_page(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8e8542437bb4070423c9754d5ba270ffdbae8c8d - https://git.kernel.org/stable/c/df77fbd8c5b222c680444801ffd20e8bbc90a56e
CVE ID: CVE-2020-36776 State: PUBLISHED Published: 2024-02-27T18:40:25.615Z Last Updated: 2025-05-04T12:40:32.375Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/cpufreq_cooling: Fix slab OOB issue Slab OOB issue is scanned by KASAN in cpu_power_to_freq(). If power is limited below the power of OPP0 in EM table, it will cause slab out-of-bound issue with negative array index. Return the lowest frequency if limited power cannot found a suitable OPP in EM table to fix this issue. Backtrace: [<ffffffd02d2a37f0>] die+0x104/0x5ac [<ffffffd02d2a5630>] bug_handler+0x64/0xd0 [<ffffffd02d288ce4>] brk_handler+0x160/0x258
fffd02d2a37f0>] die+0x104/0x5ac [<ffffffd02d2a5630>] bug_handler+0x64/0xd0 [<ffffffd02d288ce4>] brk_handler+0x160/0x258 [<ffffffd02d281e5c>] do_debug_exception+0x248/0x3f0 [<ffffffd02d284488>] el1_dbg+0x14/0xbc [<ffffffd02d75d1d4>] __kasan_report+0x1dc/0x1e0 [<ffffffd02d75c2e0>] kasan_report+0x10/0x20 [<ffffffd02d75def8>] __asan_report_load8_noabort+0x18/0x28 [<ffffffd02e6fce5c>] cpufreq_power2state+0x180/0x43c [<ffffffd02e6ead80>] power_actor_set_power+0x114/0x1d4 [<ffffffd02e6fac24>] allocate_power+0xaec/0xde0 [<ffffffd02e6f9f80>] power_allocator_throttle+0x3ec/0x5a4 [<ffffffd02e6ea888>] handle_thermal_trip+0x160/0x294 [<ffffffd02e6edd08>] thermal_zone_device_check+0xe4/0x154 [<ffffffd02d3
ffffd02e6ea888>] handle_thermal_trip+0x160/0x294 [<ffffffd02e6edd08>] thermal_zone_device_check+0xe4/0x154 [<ffffffd02d351cb4>] process_one_work+0x5e4/0xe28 [<ffffffd02d352f44>] worker_thread+0xa4c/0xfac [<ffffffd02d360124>] kthread+0x33c/0x358 [<ffffffd02d289940>] ret_from_fork+0xc/0x18 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c24a20912eef00587416628149c438e885eb1304 - https://git.kernel.org/stable/c/876a5f33e5d961d879c5436987c09b3d9ef70379 - https://git.kernel.org/stable/c/6bf443acf6ca4f666d0e4225614ba9993a3aa1a9 - https://git.kernel.org/stable/c/34ab17cc6c2c1ac93d7e5d53bb972df9a968f085