alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2024-38346 (published 2024-07-05)
The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code execution via agents on the hosts that may run as a privileged user. An attacker that can reach the cluster service on the unauthenticated port (default 9090), can exploit this to perform remote code execution on CloudStack managed hosts and result in complete compromise of the confidentiality, integrity, and availability of CloudStack managed infrastructure.

Users are recommended to restrict the network access to the cluster service port (default 9090) on a CloudStack management server host to only its peer CloudStack management server hosts. Users are recommended to upgrade to version 4.18.2.1, 4.19.0.2 or later, which addresses this issue.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: apache
Affected products: cloudstack
CVE-2024-38347 (published 2024-06-18)
CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Room Information module via the id parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: health_care_hospital_management_system_project
Affected products: health_care_hospital_management_system
CVE-2024-38348 (published 2024-06-18)
CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Staff Info module via the searvalu parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: health_care_hospital_management_system_project
Affected products: health_care_hospital_management_system
CVE-2024-38351 (published 2024-06-18)
Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register with the targeted user's email (it is unverified), 2. at some later point in time the targeted user stumble on your app and decides to sign-up with OAuth2 (_this step could be also initiated by the attacker by sending an invite email to the targeted user_), 3. on successful OAuth2 auth we search for an existing PocketBase user matching with the OAuth2 user's email and associate them, 4. because we haven't changed the password of the existing PocketBase user during the linking, the malicious actor has access to the targeted user account and will be able to login with the initially created email/password. To prevent this for happening we now reset the password for this specific case if the previously created user wasn't verified (an exception to this is if the linking is explicit/manual, aka. when you send `Authorization:TOKEN` with the OAuth2 auth call). Additionally to warn existing users we now send an email alert in case the user has logged in with password but has at least one OAuth2 account linked. The flow will be further improved with ongoing refactoring and we will start sending emails for "unrecognized device" logins (OTP and MFA is already implemented and will be available with the next v0.23.0 release in the near future). For the time being users are advised to update to version 0.22.14. There are no known workarounds for this vulnerability.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-287
CVE-2024-38353 (published 2024-07-10)
CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased. This vulnerability is fixed in 2.5.4.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-338
Affected vendors: hackmd
Affected products: codimd
CVE-2024-38354 (published 2024-07-10)
CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. This vulnerability is fixed in 2.5.4.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hackmd
Affected products: codimd
CVE-2024-38355 (published 2024-06-19)
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-20
CVE-2024-38356 (published 2024-06-19)
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
CVE-2024-38357 (published 2024-06-19)
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
CVE-2024-38358 (published 2024-06-19)
Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Programs can also crash the runtime by creating a symlink pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` which has been included in release version 4.3.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
CVE-2024-38359 (published 2024-06-20)
The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead to a DoS vector due to excessive memory allocation.  The issue was patched in lnd v0.17.0. Users should update to a version > v0.17.0 to be protected. Users unable to upgrade may set the `--rejecthtlc` CLI flag and also disable forwarding on channels via the `UpdateChanPolicyCommand`, or disable listening on a public network interface via the `--nolisten` flag as a mitigation.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
CVE-2024-38360 (published 2024-07-15)
Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue has been addressed in stable version 3.2.3 and in current betas. Users are advised to upgrade. Users unable to upgrade may manually remove the long watched words either via SQL or Rails console.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: discourse
Affected products: discourse
CVE-2024-38361 (published 2024-06-20)
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-281
Affected vendors: authzed
Affected products: spicedb
CVE-2024-38363 (published 2024-07-09)
Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new connectors. Sensitive information, such as credentials, could be exposed if a user tested a new connector on a compromised instance. The connection builder does not have access to any data processes. This vulnerability is fixed in 0.62.2.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-1336
CVE-2024-38364 (published 2024-06-26)
DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L)
Weakness: CWE-79
CVE-2024-38365 (published 2024-10-11)
btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = "<data> <data||foo>"` and `dataToRemove = "data"` btcd will remove both data pushes but Bitcoin Core's `FindAndDelete` only removes the first `<data>` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-670
Affected vendors: btcd_project
Affected products: btcd
CVE-2024-38366 (published 2024-07-01)
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-74
Affected vendors: cocoapods
Affected products: trunk.cocoapods.org
CVE-2024-38367 (published 2024-07-01)
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-488
Affected vendors: cocoapods
Affected products: trunk.cocoapods.org
CVE-2024-38368 (published 2024-07-01)
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L)
Weakness: CWE-668
Affected vendors: cocoapods
Affected products: trunk.cocoapods.org
CVE-2024-38369 (published 2024-06-24)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include reference="targetdocument"/}}` is executed with the right of the includer and not with the right of its author. This means that any user able to modify the target document can impersonate the author of the content which used the `include` macro. This vulnerability has been patched in XWiki 15.0 RC1 by making the default behavior safe.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-863
Affected vendors: xwiki
Affected products: xwiki
CVE-2024-3837 (published 2024-04-17)
Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
CVE-2024-38370 (published 2024-11-15)
GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appropriate rights. Upgrade to 10.0.16.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-285
Affected vendors: glpi-project
Affected products: glpi
CVE-2024-38371 (published 2024-06-28)
authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: goauthentik
Affected products: authentik
CVE-2024-38372 (published 2024-07-08)
Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-201
CVE-2024-38373 (published 2024-06-24)
FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-126
Affected vendors: amazon
Affected products: freertos-plus-tcp
CVE-2024-38374 (published 2024-06-28)
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-611
CVE-2024-38375 (published 2024-06-26)
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute` package.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-416
CVE-2024-38379 (published 2024-06-22)
Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.  Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.

This issue affects Apache Allura: from 1.4.0 through 1.17.0.

Users are recommended to upgrade to version 1.17.1, which fixes the issue.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: apache
Affected products: allura
CVE-2024-3838 (published 2024-04-17)
Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. (Chromium security severity: Medium)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-358
Affected vendors: google
Affected products: chrome
CVE-2024-38380 (published 2024-09-17)
This vulnerability occurs when user-supplied input is improperly sanitized and then reflected back to the user's browser, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser session.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: millbeckcommunications
Affected products: proroute_h685t-w, proroute_h685t-w_firmware
CVE-2024-38381 (published 2024-06-21)
In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix uninit-value in nci_rx_work

syzbot reported the following uninit-value access issue [1]

nci_rx_work() parses received packet from ndev->rx_q. It should be
validated header size, payload size and total packet size before
processing the packet. If an invalid packet is detected, it should be
silently discarded.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-908
Affected vendors: linux
Affected products: linux_kernel
CVE-2024-38382 (published 2024-09-02)
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: openatom
Affected products: openharmony
CVE-2024-38383 (published 2024-11-13)
Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel, microsoft
Affected products: quartus_prime, windows
CVE-2024-38384 (published 2024-06-24)
In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix list corruption from reorder of WRITE ->lqueued

__blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start
is being executed.

If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in
the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one
stat instance being added in blk_cgroup_bio_start(), then the local
list in __blkcg_rstat_flush() could be corrupted.

Fix the issue by adding one barrier.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-400
Affected vendors: linux
Affected products: linux_kernel
CVE-2024-38385 (published 2024-06-25)
In the Linux kernel, the following vulnerability has been resolved:

genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()

irq_find_at_or_after() dereferences the interrupt descriptor which is
returned by mt_find() while neither holding sparse_irq_lock nor RCU read
lock, which means the descriptor can be freed between mt_find() and the
dereference:

    CPU0                            CPU1
    desc = mt_find()
                                    delayed_free_desc(desc)
    irq_desc_get_irq(desc)

The use-after-free is reported by KASAN:

    Call trace:
     irq_get_next_irq+0x58/0x84
     show_stat+0x638/0x824
     seq_read_iter+0x158/0x4ec
     proc_reg_read_iter+0x94/0x12c
     vfs_read+0x1e0/0x2c8

    Freed by task 4471:
     slab_free_freelist_hook+0x174/0x1e0
     __kmem_cache_free+0xa4/0x1dc
     kfree+0x64/0x128
     irq_kobj_release+0x28/0x3c
     kobject_put+0xcc/0x1e0
     delayed_free_desc+0x14/0x2c
     rcu_do_batch+0x214/0x720

Guard the access with a RCU read lock section.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: linux
Affected products: linux_kernel
CVE-2024-38386 (published 2024-09-02)
in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: openatom
Affected products: openharmony
CVE-2024-38387 (published 2024-11-13)
Uncontrolled search path in the Intel(R) Graphics Driver installers for versions 15.40 and 15.45 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
CVE-2024-38388 (published 2024-06-21)
In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup

Use the control private_free callback to free the associated data
block. This ensures that the memory won't leak, whatever way the
control gets destroyed.

The original implementation didn't actually remove the ALSA
controls in hda_cs_dsp_control_remove(). It only freed the internal
tracking structure. This meant it was possible to remove/unload the
amp driver while leaving its ALSA controls still present in the
soundcard. Obviously attempting to access them could cause segfaults
or at least dereferencing stale pointers.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-401
Affected vendors: linux
Affected products: linux_kernel
CVE-2024-38389 (published 2024-11-28)
There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
CVE-2024-3839 (published 2024-04-17)
Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google
Affected products: chrome
CVE-2024-38390 (published 2024-06-21)
In the Linux kernel, the following vulnerability has been resolved:

drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails

Calling a6xx_destroy() before adreno_gpu_init() leads to a null pointer
dereference on:

msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL);

as gpu->pdev is only assigned in:

a6xx_gpu_init()
|_ adreno_gpu_init
    |_ msm_gpu_init()

Instead of relying on handwavy null checks down the cleanup chain,
explicitly de-allocate the LLC data and free a6xx_gpu instead.

Patchwork: https://patchwork.freedesktop.org/patch/588919/
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: linux
Affected products: linux_kernel
CVE-2024-38394 (published 2024-06-16)
Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVE-2024-38395 (published 2024-06-16)
In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: iterm2
Affected products: iterm2
CVE-2024-38396 (published 2024-06-16)
An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: iterm2
Affected products: iterm2
CVE-2024-38397 (published 2024-10-07)
Transient DOS while parsing probe response and assoc response frame.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g_platform, flight_rb5_5g_platform_firmware, immersive_home_3210_platform, immersive_home_3210_platform_firmware, immersive_home_326_platform, immersive_home_326_platform_firmware, ipq5300, ipq5300_firmware, ipq5302, ipq5302_firmware, ipq5312, ipq5312_firmware, ipq5332, ipq5332_firmware, ipq9008, ipq9008_firmware, ipq9554
CVE-2024-38399 (published 2024-10-07)
Memory corruption while processing user packets to generate page faults.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qamsrv1h, qamsrv1h_firmware, qamsrv1m, qamsrv1m_firmware, qca6574au, qca6574au_firmware, qca6595, qca6595_firmware, qca6595au, qca6595au_firmware, qca6688aq, qca6688aq_firmware, qca6696
CVE-2024-3840 (published 2024-04-17)
Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-285
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2024-38401 (published 2024-09-02)
Memory corruption while processing concurrent IOCTL calls.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, c-v2x_9150, c-v2x_9150_firmware, fastconnect_7800, fastconnect_7800_firmware, qca6574a, qca6574a_firmware, qca6584au, qca6584au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca6698aq, qca6698aq_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qcc710, qcc710_firmware, qcn6224, qcn6224_firmware, qcn6274
CVE-2024-38402 (published 2024-09-02)
Memory corruption while processing IOCTL call for getting group info.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g, flight_rb5_5g_firmware, mdm9628, mdm9628_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8620p, qam8620p_firmware, qam8650p
CVE-2024-38403 (published 2024-11-04)
Transient DOS while parsing BTM ML IE when per STA profile is not included.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qam8255p, qam8255p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qca6554a, qca6554a_firmware, qca6564au, qca6564au_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6584au, qca6584au_firmware, qca6595
CVE-2024-38405 (published 2024-11-04)
Transient DOS while processing the CU information from RNR IE.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8620p, qam8620p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qamsrv1h, qamsrv1h_firmware, qamsrv1m, qamsrv1m_firmware, qca6391, qca6391_firmware, qca6554a
CVE-2024-38406 (published 2024-11-04)
Memory corruption while handling IOCTL calls in JPEG Encoder driver.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6800, fastconnect_6800_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6430, qca6430_firmware, qcm5430, qcm5430_firmware, qcm6490, qcm6490_firmware, qcs5430, qcs5430_firmware, qcs6490
CVE-2024-38407 (published 2024-11-04)
Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6800, fastconnect_6800_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6430, qca6430_firmware, qcm5430, qcm5430_firmware, qcm6490, qcm6490_firmware, qcs5430, qcs5430_firmware, qcs6490
CVE-2024-38408 (published 2024-11-04)
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-310
Affected vendors: qualcomm
Affected products: 315_5g_iot_modem, 315_5g_iot_modem_firmware, aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6800, fastconnect_6800_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g_platform, flight_rb5_5g_platform_firmware, immersive_home_214_platform, immersive_home_214_platform_firmware, immersive_home_216_platform, immersive_home_216_platform_firmware, immersive_home_316_platform
CVE-2024-38409 (published 2024-11-04)
Memory corruption while station LL statistic handling.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qcc2073, qcc2073_firmware, qcc2076, qcc2076_firmware, qcm5430, qcm5430_firmware, qcm6490, qcm6490_firmware, qcs5430, qcs5430_firmware, qcs6490, qcs6490_firmware, sc8380xp, sc8380xp_firmware, sdm429w, sdm429w_firmware, snapdragon_429_mobile_platform, snapdragon_429_mobile_platform_firmware, snapdragon_8cx_gen_3_compute_platform
CVE-2024-3841 (published 2024-04-17)
Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: fedoraproject, google, microsoft
Affected products: chrome, fedora, windows
CVE-2024-38410 (published 2024-11-04)
Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: qualcomm
Affected products: fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qcc2073, qcc2073_firmware, qcc2076, qcc2076_firmware, qcm5430, qcm5430_firmware, qcm6490, qcm6490_firmware, qcs5430, qcs5430_firmware, qcs6490, qcs6490_firmware, sc8380xp, sc8380xp_firmware, sdm429w, sdm429w_firmware, snapdragon_429_mobile_platform, snapdragon_429_mobile_platform_firmware, snapdragon_8cx_gen_3_compute_platform
CVE-2024-38415 (published 2024-11-04)
Memory corruption while handling session errors from firmware.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: 215_mobile_platform, 215_mobile_platform_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6800, fastconnect_6800_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g_platform, flight_rb5_5g_platform_firmware, mdm9628, mdm9628_firmware, qam8295p, qam8295p_firmware, qca6174a
CVE-2024-38419 (published 2024-11-04)
Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, flight_rb5_5g_platform, flight_rb5_5g_platform_firmware, mdm9628, mdm9628_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8620p, qam8620p_firmware, qam8650p
CVE-2024-38421 (published 2024-11-04)
Memory corruption while processing GPU commands.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: fastconnect_6200, fastconnect_6200_firmware, fastconnect_7800, fastconnect_7800_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8620p, qam8620p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qamsrv1h, qamsrv1h_firmware, qamsrv1m, qamsrv1m_firmware, qca6391, qca6391_firmware, qca6574, qca6574_firmware, qca6574a, qca6574a_firmware, qca6574au
CVE-2024-38422 (published 2024-11-04)
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-680
Affected vendors: qualcomm
Affected products: 205_mobile_platform, 205_mobile_platform_firmware, 215_mobile_platform, 215_mobile_platform_firmware, 315_5g_iot_modem, 315_5g_iot_modem_firmware, 9206_lte_modem, 9206_lte_modem_firmware, apq8017, apq8017_firmware, apq8064au, apq8064au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, c-v2x_9150, c-v2x_9150_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024
CVE-2024-38423 (published 2024-11-04)
Memory corruption while processing GPU page table switch.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: 205_mobile_platform, 205_mobile_platform_firmware, 215_mobile_platform, 215_mobile_platform_firmware, 315_5g_iot_modem, 315_5g_iot_modem_firmware, 9206_lte_modem, 9206_lte_modem_firmware, apq8017, apq8017_firmware, apq8064au, apq8064au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, c-v2x_9150, c-v2x_9150_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024
CVE-2024-38424 (published 2024-11-04)
Memory corruption during GNSS HAL process initialization.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, fastconnect_6200, fastconnect_6200_firmware, fastconnect_6700, fastconnect_6700_firmware, fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, qam8255p, qam8255p_firmware, qam8620p, qam8620p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qamsrv1h, qamsrv1h_firmware, qamsrv1m, qamsrv1m_firmware, qca6174a, qca6174a_firmware, qca6574
CVE-2024-38425 (published 2024-10-07)
Information disclosure while sending implicit broadcast containing APP launch information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
Weakness: CWE-285
Affected vendors: qualcomm
Affected products: fastconnect_6900, fastconnect_6900_firmware, fastconnect_7800, fastconnect_7800_firmware, sm7435, sm7435_firmware, sm8635, sm8635_firmware, sm8750, sm8750_firmware, snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\), snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\)_firmware, snapdragon_480_5g_mobile_platform, snapdragon_480_5g_mobile_platform_firmware, snapdragon_4_gen_1_mobile_platform, snapdragon_4_gen_1_mobile_platform_firmware, snapdragon_4_gen_2_mobile_platform, snapdragon_4_gen_2_mobile_platform_firmware, snapdragon_662_mobile_platform, snapdragon_662_mobile_platform_firmware, snapdragon_680_4g_mobile_platform, snapdragon_680_4g_mobile_platform_firmware, snapdragon_685_4g_mobile_platform_\(sm6225-ad\), snapdragon_685_4g_mobile_platform_\(sm6225-ad\)_firmware, snapdragon_695_5g_mobile_platform
CVE-2024-38427 (published 2024-06-16)
In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTagXml.cpp results in unconditionally returning false.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-252
CVE-2024-38428 (published 2024-06-16)
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-436
Affected vendors: gnu
Affected products: wget
CVE-2024-38429 (published 2024-07-30)
Matrix Tafnit v8

 -  CWE-552: Files or Directories Accessible to External Parties
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: matrix-globalservices
Affected products: tafnit
CVE-2024-3843 (published 2024-04-17)
Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-290
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2024-38430 (published 2024-07-30)
Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: matrix-globalservices
Affected products: tafnit
CVE-2024-38431 (published 2024-07-30)
Matrix Tafnit v8

 - 

CWE-204: Observable Response Discrepancy
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-204
Affected vendors: matrix-globalservices
Affected products: tafnit
CVE-2024-38432 (published 2024-07-30)
Matrix Tafnit v8

 - 



CWE-646: Reliance on File Name or Extension of Externally-Supplied File
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-646
Affected vendors: matrix-globalservices
Affected products: tafnit
CVE-2024-38433 (published 2024-07-11)
Nuvoton - CWE-305: Authentication Bypass by Primary Weakness

An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock

reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code

execution.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-305
Affected vendors: nuvoton
Affected products: npcm705r, npcm705r_firmware, npcm710r, npcm710r_firmware, npcm730r, npcm730r_firmware, npcm750r, npcm750r_firmware
CVE-2024-38434 (published 2024-07-21)
Unitronics Vision PLC –  

CWE-676: Use of Potentially Dangerous Function may allow security feature bypass
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-676
CVE-2024-38435 (published 2024-07-21)
Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-703
Affected vendors: unitronics
Affected products: visilogic
CVE-2024-38436 (published 2024-07-21)
Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: commugen
Affected products: sox_365
CVE-2024-38437 (published 2024-07-21)
D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-288
Affected vendors: dlink
Affected products: dsl-225, dsl-225_firmware
CVE-2024-38438 (published 2024-07-21)
D-Link - 

CWE-294: Authentication Bypass by Capture-replay
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-294
Affected vendors: dlink
Affected products: dsl-225, dsl-225_firmware
CVE-2024-38439 (published 2024-06-16)
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19 are also fixed versions.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: netatalk
Affected products: netatalk
CVE-2024-3844 (published 2024-04-17)
Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-358
Affected vendors: fedoraproject, google
Affected products: chrome, fedora