Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
References: - https://git.kernel.org/stable/c/f4b994fccbb6f294c4b31a6ca0114b09f7245043 - https://git.kernel.org/stable/c/68879386180c0efd5a11e800b0525a01068c9457
CVE ID: CVE-2024-36028 State: PUBLISHED Published: 2024-05-30T15:19:42.538Z Last Updated: 2025-05-04T12:56:18.568Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() When I did memory failure tests recently, below warning occurs: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 8 PID: 1011 at kernel/locking/lockdep.c:232 __lock_acquire+0xccb/0x1ca0 Modules linked in: mce_inject hwpoison_inject CPU: 8 PID: 1011 Comm: bash Kdump: loaded Not tainted 6.9.0-rc3-next-20240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15582
rc3-next-20240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire+0xccb/0x1ca0 RSP: 0018:ffffa7a1c7fe3bd0 EFLAGS: 00000082 RAX: 0000000000000000 RBX: eb851eb853975fcf RCX: ffffa1ce5fc1c9c8 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffffa1ce5fc1c9c0 RBP: ffffa1c6865d3280 R08: ffffffffb0f570a8 R09: 0000000000009ffb R10: 0000000000000286 R11: ffffffffb0f2ad50 R12: ffffa1c6865d3d10 R13: ffffa1c6865d3c70 R14: 0000000000000000 R15: 0000000000000004 FS: 00007ff9f32aa740(0000) GS:ffffa1ce5fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0
9f32aa740(0000) GS:ffffa1ce5fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff9f3134ba0 CR3: 00000008484e4000 CR4: 00000000000006f0 Call Trace: <TASK> lock_acquire+0xbe/0x2d0 _raw_spin_lock_irqsave+0x3a/0x60 hugepage_subpool_put_pages.part.0+0xe/0xc0 free_huge_folio+0x253/0x3f0 dissolve_free_huge_page+0x147/0x210 __page_handle_poison+0x9/0x70 memory_failure+0x4e6/0x8c0 hard_offline_page_store+0x55/0xa0 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xbc/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff9f3114887 RSP: 002b:00007ffecbacb458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ff
wframe+0x77/0x7f RIP: 0033:0x7ff9f3114887 RSP: 002b:00007ffecbacb458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007ff9f3114887 RDX: 000000000000000c RSI: 0000564494164e10 RDI: 0000000000000001 RBP: 0000564494164e10 R08: 00007ff9f31d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007ff9f321b780 R14: 00007ff9f3217600 R15: 00007ff9f3216a00 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 8 PID: 1011 Comm: bash Kdump: loaded Not tainted 6.9.0-rc3-next-20240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-pre
240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> panic+0x326/0x350 check_panic_on_warn+0x4f/0x50 __warn+0x98/0x190 report_bug+0x18e/0x1a0 handle_bug+0x3d/0x70 exc_invalid_op+0x18/0x70 asm_exc_invalid_op+0x1a/0x20 RIP: 0010:__lock_acquire+0xccb/0x1ca0 RSP: 0018:ffffa7a1c7fe3bd0 EFLAGS: 00000082 RAX: 0000000000000000 RBX: eb851eb853975fcf RCX: ffffa1ce5fc1c9c8 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffffa1ce5fc1c9c0 RBP: ffffa1c6865d3280 R08: ffffffffb0f570a8 R09: 0000000000009ffb R10: 0000000000000286 R11: ffffffffb0f2ad50 R12: ffffa1c6865d3d10 R13: ffffa1c6865d3c70 R14
f570a8 R09: 0000000000009ffb R10: 0000000000000286 R11: ffffffffb0f2ad50 R12: ffffa1c6865d3d10 R13: ffffa1c6865d3c70 R14: 0000000000000000 R15: 0000000000000004 lock_acquire+0xbe/0x2d0 _raw_spin_lock_irqsave+0x3a/0x60 hugepage_subpool_put_pages.part.0+0xe/0xc0 free_huge_folio+0x253/0x3f0 dissolve_free_huge_page+0x147/0x210 __page_handle_poison+0x9/0x70 memory_failure+0x4e6/0x8c0 hard_offline_page_store+0x55/0xa0 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xbc/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff9f3114887 RSP: 002b:00007ffecbacb458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c R
887 RSP: 002b:00007ffecbacb458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007ff9f3114887 RDX: 000000000000000c RSI: 0000564494164e10 RDI: 0000000000000001 RBP: 0000564494164e10 R08: 00007ff9f31d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007ff9f321b780 R14: 00007ff9f3217600 R15: 00007ff9f3216a00 </TASK> After git bisecting and digging into the code, I believe the root cause is that _deferred_list field of folio is unioned with _hugetlb_subpool field. In __update_and_free_hugetlb_folio(), folio->_deferred_ ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
ree_hugetlb_folio(), folio->_deferred_ ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2effe407f7563add41750fd7e03da4ea44b98099 - https://git.kernel.org/stable/c/7e0a322877416e8c648819a8e441cf8c790b2cce - https://git.kernel.org/stable/c/9c9b32d46afab2d911897914181c488954012300 - https://git.kernel.org/stable/c/52ccdde16b6540abe43b6f8d8e1e1ec90b0983af
CVE ID: CVE-2024-36029 State: PUBLISHED Published: 2024-05-30T15:19:43.110Z Last Updated: 2025-05-04T09:10:53.920Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci code registers LED device and uses host->runtime_suspended flag to protect access to it. The sdhci-msm driver doesn't set this flag, which causes a crash when LED is accessed while controller is runtime suspended. Fix this by setting the flag correctly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1200481cd6069d16ce20133bcd86
SA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1200481cd6069d16ce20133bcd86f5825e26a045 - https://git.kernel.org/stable/c/a957ea5aa3d3518067a1ba32c6127322ad348d20 - https://git.kernel.org/stable/c/56b99a52229d7f8cd1f53d899f57aa7eb4b199af - https://git.kernel.org/stable/c/f653b04a818c490b045c97834d559911479aa1c5 - https://git.kernel.org/stable/c/f8def10f73a516b771051a2f70f2f0446902cb4f
CVE ID: CVE-2024-36030 State: PUBLISHED Published: 2024-05-30T15:19:43.693Z Last Updated: 2025-05-04T09:10:54.964Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix the double free in rvu_npc_freemem() Clang static checker(scan-build) warning： drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column 2 Attempt to free released memory. npc_mcam_rsrcs_deinit() has released 'mcam->counters.bmap'. Deleted this redundant kfree() to fix this double free problem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f5aa87a2c0a72132ffc793fb0
CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f5aa87a2c0a72132ffc793fb0a5375b2a65d520a - https://git.kernel.org/stable/c/6e965eba43e9724f3e603d7b7cc83e53b23d155e
CVE ID: CVE-2024-36031 State: PUBLISHED Published: 2024-05-30T15:23:46.831Z Last Updated: 2025-11-04T17:20:59.085Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
expiry is only called when the pre-parser sets a specific expiry. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ad2011ea787928b2accb5134f1e423b11fe80a8a - https://git.kernel.org/stable/c/ed79b93f725cd0da39a265dc23d77add1527b9be - https://git.kernel.org/stable/c/e4519a016650e952ad9eb27937f8c447d5a4e06d - https://git.kernel.org/stable/c/25777f3f4e1f371d16a594925f31e37ce07b6ec7 - https://git.kernel.org/stable/c/939a08bcd4334bad4b201e60bd0ae1f278d71d41 - https://git.kernel.org/stable/c/cc219cb8afbc40ec100c0de941047bb29373126a - https://git.kernel.org/stable/c/9da27fb65a14c18efd4473e2e82b76b53ba60252
CVE ID: CVE-2024-36032 State: PUBLISHED Published: 2024-05-30T15:23:47.423Z Last Updated: 2025-05-04T09:10:57.176Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffe - https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488 - https://
0ab62042dcceaf18844d0feadbb962cffe - https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488 - https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45a - https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1 - https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2
CVE ID: CVE-2024-36033 State: PUBLISHED Published: 2024-05-30T15:23:48.022Z Last Updated: 2025-05-04T09:10:58.247Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching board id Add the missing sanity check when fetching the board id to avoid leaking slab data when later requesting the firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a3dff121a7f5104c4c2d47edaa2351837ef645dd - https://git.kernel.org/stable/c/bcccdc947d2ca5972b1e92d0dea10803ddc08ceb - https://git.kernel.org/stable/c/ba307abed5e09759845c735ba036f
el.org/stable/c/bcccdc947d2ca5972b1e92d0dea10803ddc08ceb - https://git.kernel.org/stable/c/ba307abed5e09759845c735ba036f8c12f55b209 - https://git.kernel.org/stable/c/f30c37cb4549baf8377434892d520fe7769bdba7 - https://git.kernel.org/stable/c/0adcf6be1445ed50bfd4a451a7a782568f270197
CVE ID: CVE-2024-36034 State: PUBLISHED Published: 2024-08-12T07:23:17.212Z Last Updated: 2024-08-12T12:27:27.466Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/sqlfix-8003.html
CVE ID: CVE-2024-36035 State: PUBLISHED Published: 2024-08-12T07:19:54.491Z Last Updated: 2024-08-12T13:48:39.216Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/sqlfix-8003.html
CVE ID: CVE-2024-36036 State: PUBLISHED Published: 2024-05-27T17:58:16.113Z Last Updated: 2024-10-31T15:21:20.581Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ManageEngine Products: ADAudit Plus Description: Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/products/active-directory-audit/cve-2024-36036.html
CVE ID: CVE-2024-36037 State: PUBLISHED Published: 2024-05-27T17:59:52.711Z Last Updated: 2024-10-25T18:58:51.787Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-863 Description: Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/products/active-directory-audit/cve-2024-36037.html
CVE ID: CVE-2024-36038 State: PUBLISHED Published: 2024-06-24T11:45:11.075Z Last Updated: 2024-08-02T03:30:12.484Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: ManageEngine Products: OpManager Problem Types: CWE-79 Description: Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy server option. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/itom/advisory/cve-2024-36038.html
CVE ID: CVE-2024-36039 State: PUBLISHED Published: 2024-05-21T00:00:00 Last Updated: 2024-11-21T15:27:54.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/PyMySQL/PyMySQL/releases/tag/v1.1.1 - https://lists.debian.org/debian-lts-announce/2024/05/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35VOJS3SRJNLQIO7YTZFNM6RWHIHWTMK/ - https://lists.fedoraproject.org/archives/list/package-announ
doraproject.org/message/35VOJS3SRJNLQIO7YTZFNM6RWHIHWTMK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23VXBV34GFRICCVYZ6KFMSSWY5UEXCF5/
CVE ID: CVE-2024-36041 State: PUBLISHED Published: 2024-07-05T00:00:00.000Z Last Updated: 2025-11-04T22:06:18.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://invent.kde.org/p
tory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://invent.kde.org/plasma/plasma-workspace/ - https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html - https://github.com/KDE/plasma-workspace/tags - https://kde.org/info/security/advisory-20240531-1.txt
CVE ID: CVE-2024-36042 State: PUBLISHED Published: 2024-06-03T05:47:04.246Z Last Updated: 2025-02-13T15:59:10.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://silverpeas.org/ - https://github.com/Silverpeas/Silverpeas-Core/tags - https://gist.github.com/ChrisPritchard/4b6d5c70d9329ef116266a6c238dcb2d
CVE ID: CVE-2024-36043 State: PUBLISHED Published: 2024-05-18T19:24:45.545Z Last Updated: 2025-02-13T15:59:10.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/surveyjs/survey-library/commit/b25fbf0efd4486dc55f836240bebc2305803b96d - https://github.com/surveyjs/survey-library/issues/8286
CVE ID: CVE-2024-36046 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T15:55:01.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infoblox NIOS through 8.6.4 executes with more privileges than required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.infoblox.com/s/article/000010390
CVE ID: CVE-2024-36047 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T15:52:31.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.infoblox.com/s/article/000010391
CVE ID: CVE-2024-36048 State: PUBLISHED Published: 2024-05-18T00:00:00.000Z Last Updated: 2025-11-04T22:06:19.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560317 - https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560368 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap
project.org/c/qt/qtnetworkauth/+/560368 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGB6KUPJFQWUBKXVDPJUMAD6KNJJEWPW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPHAI3DKDCIU6XLNS6PV6GFS2PHH3GZM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZOOZZZSK5PNRHFGQMUGUHVYWLILFJCRS/
CVE ID: CVE-2024-36049 State: PUBLISHED Published: 2024-05-24T16:25:38.065Z Last Updated: 2025-02-13T15:59:11.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and passwords from the database server, using an unencrypted connection. This allows attackers in a machine-in-the-middle position read and write access to personally identifiable information (PII) and especially payroll data and the ability to impersonate legitimate users with respect to the audit log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
with respect to the audit log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-007/
CVE ID: CVE-2024-36050 State: PUBLISHED Published: 2024-05-18T21:24:10.412Z Last Updated: 2025-06-27T11:59:52.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NixOS/nix/issues/969 - https://github.com/NixOS/ofborg/issues/68#issuecomment-2082789441 - https://discourse.nixos.org/t/nixpkgs-supply-chain-security-project/34345 - https://discourse.nixo
ecomment-2082789441 - https://discourse.nixos.org/t/nixpkgs-supply-chain-security-project/34345 - https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/26
CVE ID: CVE-2024-36051 State: REJECTED Published: 2024-10-10T00:00:00 Last Updated: 2024-10-11T20:26:22.924642 Description: No description available.
CVE ID: CVE-2024-36052 State: PUBLISHED Published: 2024-05-21T16:37:49.665Z Last Updated: 2025-02-13T15:59:12.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rarlab.com/rarnew.htm - https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983
CVE ID: CVE-2024-36053 State: PUBLISHED Published: 2024-05-19T15:16:18.773Z Last Updated: 2025-02-13T15:59:12.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_data_received_cb, and Service.remove. A user can modify a service name in a ~/.linuxmint/mintUpload/services/service file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/linuxmint/mintupload/issues/42 - https://github.com/linuxmint/mintupload/issues/43 - http://packages.linuxmint.com/pool/main/m/mintuplo
pload/issues/42 - https://github.com/linuxmint/mintupload/issues/43 - http://packages.linuxmint.com/pool/main/m/mintupload/
CVE ID: CVE-2024-36054 State: PUBLISHED Published: 2024-05-26T22:48:40.439Z Last Updated: 2025-02-13T15:59:13.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory (and consequently gain all privileges) via IOCTL 0x9c4064b8 (via MmMapIoSpace) and IOCTL 0x9c406490 (via ZwMapViewOfSection). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.marvintest.com/Downloads.aspx?prodId=12&search=package - https://www.marvintest.com/KnowledgeBase/KBArticle.aspx?ID=362
CVE ID: CVE-2024-36055 State: PUBLISHED Published: 2024-05-26T22:49:27.814Z Last Updated: 2025-02-13T15:59:13.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write access via the MmMapIoSpace API (IOCTL 0x9c40a4f8, 0x9c40a4e8, 0x9c40a4c0, 0x9c40a4c4, 0x9c40a4ec, and seven others), leading to a denial of service (BSOD). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.marvintest.com/Downloads.aspx?prodId=12&search=package - https://www.marvintest.com/KnowledgeBase/KBArticle.aspx?ID=362
CVE ID: CVE-2024-36056 State: PUBLISHED Published: 2024-05-26T22:50:09.731Z Last Updated: 2025-02-13T15:59:14.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c406490 (for IoAllocateMdl, MmBuildMdlForNonPagedPool, and MmMapLockedPages), leading to NT AUTHORITY\SYSTEM privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.marvintest.com/Downloads.aspx?prodId=12&search=package - https://www.marvintest.com/KnowledgeBase/KBArticle.aspx?ID=362