Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37040 State: PUBLISHED Published: 2024-06-12T16:56:06.117Z Last Updated: 2024-08-02T03:43:50.968Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Schneider Electric Products: Sage 1410, Sage 1430, Sage 1450, Sage 2400, Sage 3030 Magnum, Sage 4400 Problem Types: CWE-120 Description: CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE ID: CVE-2024-37041 State: PUBLISHED Published: 2024-11-22T15:33:41.157Z Last Updated: 2024-11-22T17:05:00.340Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-120, CWE-122 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/sec
29 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-43
CVE ID: CVE-2024-37042 State: PUBLISHED Published: 2024-11-22T15:33:35.425Z Last Updated: 2024-11-22T17:05:01.042Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/sec
CVE ID: CVE-2024-37043 State: PUBLISHED Published: 2024-11-22T15:33:29.576Z Last Updated: 2024-11-22T17:05:01.457Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read the contents of unexpected files and expose sensitive data. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qn
ero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-43
CVE ID: CVE-2024-37044 State: PUBLISHED Published: 2024-11-22T15:33:22.007Z Last Updated: 2024-11-22T17:05:00.517Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-120, CWE-121 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/sec
CVE ID: CVE-2024-37045 State: PUBLISHED Published: 2024-11-22T15:33:15.661Z Last Updated: 2024-11-22T17:05:01.188Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/sec
CVE ID: CVE-2024-37046 State: PUBLISHED Published: 2024-11-22T15:33:09.701Z Last Updated: 2024-11-22T17:05:01.576Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read the contents of unexpected files and expose sensitive data. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qn
CVE ID: CVE-2024-37047 State: PUBLISHED Published: 2024-11-22T15:33:03.459Z Last Updated: 2024-11-22T17:05:00.638Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-120, CWE-121 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/sec
CVE ID: CVE-2024-37048 State: PUBLISHED Published: 2024-11-22T15:32:56.395Z Last Updated: 2024-11-22T17:05:01.325Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/sec
CVE ID: CVE-2024-37049 State: PUBLISHED Published: 2024-11-22T15:32:49.741Z Last Updated: 2024-11-22T17:05:00.765Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-120, CWE-121 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/sec
CVE ID: CVE-2024-37050 State: PUBLISHED Published: 2024-11-22T15:32:44.371Z Last Updated: 2024-11-22T17:05:00.904Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-120, CWE-121 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/sec
CVE ID: CVE-2024-37051 State: PUBLISHED Published: 2024-06-10T15:58:06.021Z Last Updated: 2025-02-13T17:52:58.741Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: JetBrains Products: IntelliJ IDEA, Aqua, CLion, DataGrip, DataSpell, GoLand, MPS, PhpStorm, PyCharm, Rider, RubyMine, RustRover, WebStorm Problem Types: CWE-522 Description: GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.
7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/ - https://security.netapp.com/advisory/ntap-20240705-0004/
CVE ID: CVE-2024-37052 State: PUBLISHED Published: 2024-06-04T11:59:35.035Z Last Updated: 2024-08-02T03:43:50.871Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37053 State: PUBLISHED Published: 2024-06-04T12:00:15.162Z Last Updated: 2024-08-02T03:43:50.998Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37054 State: PUBLISHED Published: 2024-06-04T12:00:34.492Z Last Updated: 2024-08-02T03:43:50.887Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37055 State: PUBLISHED Published: 2024-06-04T12:00:51.438Z Last Updated: 2024-08-02T03:43:50.975Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37056 State: PUBLISHED Published: 2024-06-04T12:01:09.258Z Last Updated: 2024-08-02T03:43:50.908Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37057 State: PUBLISHED Published: 2024-06-04T12:01:28.229Z Last Updated: 2024-08-02T03:43:51.015Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37058 State: PUBLISHED Published: 2024-06-04T12:01:43.266Z Last Updated: 2024-08-02T03:43:50.989Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37059 State: PUBLISHED Published: 2024-06-04T12:01:58.728Z Last Updated: 2024-08-02T03:43:50.934Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37060 State: PUBLISHED Published: 2024-06-04T12:02:12.858Z Last Updated: 2024-08-02T03:43:50.968Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37061 State: PUBLISHED Published: 2024-06-04T12:02:23.269Z Last Updated: 2024-08-02T03:43:50.824Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MLflow Products: MLflow Problem Types: CWE-94 Description: Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE ID: CVE-2024-37062 State: PUBLISHED Published: 2024-06-04T12:02:37.865Z Last Updated: 2024-08-02T03:43:51.029Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: YdataAI Products: ydata-profiling Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/ydata-june2024
CVE ID: CVE-2024-37063 State: PUBLISHED Published: 2024-06-04T12:02:53.320Z Last Updated: 2024-08-02T03:43:50.868Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: YdataAI Products: ydata-profiling Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/ydata-june2024
CVE ID: CVE-2024-37064 State: PUBLISHED Published: 2024-06-04T12:03:07.125Z Last Updated: 2024-08-02T03:43:50.922Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: YdataAI Products: ydata-profiling Problem Types: CWE-502 Description: Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/ydata-june2024
CVE ID: CVE-2024-37065 State: PUBLISHED Published: 2024-06-04T12:03:19.459Z Last Updated: 2024-08-02T03:43:50.919Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Skops-dev Products: Skops Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/skops-june2024
CVE ID: CVE-2024-37066 State: PUBLISHED Published: 2024-07-19T12:05:11.395Z Last Updated: 2024-08-02T03:43:50.813Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Wyze Products: Wyze Cam V4 Pro Problem Types: CWE-78 Description: A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/sai-security-advisory/2024-7-wyze/ - https://forums.wyze.com/t/security-advisory/289256
CVE ID: CVE-2024-37068 State: PUBLISHED Published: 2024-09-07T13:43:38.884Z Last Updated: 2024-09-21T09:59:46.045Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Maximo Application Suite Problem Types: CWE-327 Description: IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167725 - https://exchange.xforce.ibmcloud.com/vulnerabilities/292799
CVE ID: CVE-2024-37070 State: PUBLISHED Published: 2024-11-19T19:24:02.919Z Last Updated: 2025-01-26T16:01:56.431Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-497 Description: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176346
CVE ID: CVE-2024-37071 State: PUBLISHED Published: 2024-12-07T12:53:31.722Z Last Updated: 2024-12-09T18:02:16.298Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-789 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7175940
CVE ID: CVE-2024-37077 State: PUBLISHED Published: 2024-07-02T08:14:14.059Z Last Updated: 2024-08-02T03:43:50.882Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-787 Description: in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE ID: CVE-2024-37078 State: PUBLISHED Published: 2024-06-25T14:22:35.558Z Last Updated: 2025-11-03T21:55:32.951Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17
KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writebac
cks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/95f6f81e50d858a7c9aa7c795ec14a0ac3819118 - https://git.kernel.org/stable/c/a75b8f493dfc48aa38c518430bd9e03b53bffebe - https://git.kernel.org/stable/c/0ecfe3a92869a59668d27228dabbd7965e83567f - https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627 - https://git.kernel.org
7228dabbd7965e83567f - https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627 - https://git.kernel.org/stable/c/271dcd977ccda8c7a26e360425ae7b4db7d2ecc0 - https://git.kernel.org/stable/c/614d397be0cf43412b3f94a0f6460eddced8ce92 - https://git.kernel.org/stable/c/1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d - https://git.kernel.org/stable/c/a4ca369ca221bb7e06c725792ac107f0e48e82e7