deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-35923
Published: 2024-05-19
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-35924
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Limit read size on v1.2

Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was
increased from 16 to 256. In order to avoid overflowing reads for older
systems, add a mechanism to use the read UCSI version to truncate read
sizes on UCSI v1.2.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0defcaa09d3b21e8387829ee3a652c43fa91e13f; https://git.kernel.org/stable/c/266f403ec47573046dee4bcebda82777ce702c40; https://git.kernel.org/stable/c/b3db266fb031fba88c423d4bb8983a73a3db6527
CVE: CVE-2024-35925
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

block: prevent division by zero in blk_rq_stat_sum()

The expression dst->nr_samples + src->nr_samples may
have zero value on overflow. It is necessary to add
a check to avoid division by zero.

Found by Linux Verification Center (linuxtesting.org) with Svace.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/21e7d72d0cfcbae6042d498ea2e6f395311767f8; https://git.kernel.org/stable/c/512a01da7134bac8f8b373506011e8aaa3283854; https://git.kernel.org/stable/c/5f7fd6aa4c4877d77133ea86c14cf256f390b2fe
CVE: CVE-2024-35926
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix async_disable descriptor leak

The disable_async paths of iaa_compress/decompress() don't free idxd
descriptors in the async_disable case. Currently this only happens in
the testcases where req->dst is set to null. Add a test to free them
in those paths.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/262534ddc88dfea7474ed18adfecf856e4fbe054; https://git.kernel.org/stable/c/d994f7d77aaded05dc05af58a2720fd4f4b72a83; https://git.kernel.org/stable/c/262534ddc88dfea7474ed18adfecf856e4fbe054
CVE: CVE-2024-35928
Published: 2024-05-19
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-35929
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()

For the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and
CONFIG_RCU_LAZY=y, the following scenarios will trigger WARN_ON_ONCE()
in the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions:

        CPU2                                               CPU11
kthread
rcu_nocb_cb_kthread                                       ksys_write
rcu_do_batch                                              vfs_write
rcu_torture_timer_cb                                      proc_sys_write
__kmem_cache_free                                         proc_sys_call_handler
kmemleak_free                                             drop_caches_sysctl_handler
delete_object_full                                        drop_slab
__delete_object                                           shrink_slab
put_object                                                lazy_rcu_shrink_scan
call_rcu                                                  rcu_nocb_flush_bypass
__call_rcu_commn                                            rcu_nocb_bypass_lock
                                                            raw_spin_trylock(&rdp->nocb_bypass_lock) fail
                                                            atomic_inc(&rdp->nocb_lock_contended);
rcu_nocb_wait_contended                                     WARN_ON_ONCE(smp_processor_id() != rdp->cpu);
 WARN_ON_ONCE(atomic_read(&rdp->nocb_lock_contended))                                          |
                            |_ _ _ _ _ _ _ _ _ _same rdp and rdp->cpu != 11_ _ _ _ _ _ _ _ _ __|

Reproduce this bug with "echo 3 > /proc/sys/vm/drop_caches".

This commit therefore uses rcu_nocb_try_flush_bypass() instead of
rcu_nocb_flush_bypass() in lazy_rcu_shrink_scan().  If the nocb_bypass
queue is being flushed, then rcu_nocb_try_flush_bypass will return
directly.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/4d58c9fb45c70e62c19e8be3f3605889c47601bc; https://git.kernel.org/stable/c/927d1f4f77e4784ab3944a9df86ab14d1cd3185a; https://git.kernel.org/stable/c/dda98810b552fc6bf650f4270edeebdc2f28bd3f
CVE: CVE-2024-35930
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()

The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an
unsuccessful status.  In such cases, the elsiocb is not issued, the
completion is not called, and thus the elsiocb resource is leaked.

Check return value after calling lpfc_sli4_resume_rpi() and conditionally
release the elsiocb resource.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/07a2aa674fca679316b8ac51440adb895b53a7cf; https://git.kernel.org/stable/c/2ae917d4bcab80ab304b774d492e2fcd6c52c06b; https://git.kernel.org/stable/c/3320126ed3afbc[PII_REDACTED]b340f91a4d61c8f
CVE: CVE-2024-35933
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: Fix null ptr deref in btintel_read_version

If hci_cmd_sync_complete() is triggered and skb is NULL, then
hdev->req_skb is NULL, which will cause this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/22d3053ef05f0b5045e45bd91e[PII_REDACTED]d65e; https://git.kernel.org/stable/c/b19fe5eea619d54eea59bb8a37c0f8d00ef0e912; https://git.kernel.org/stable/c/b79e040910101b020931ba0c9a6b77e81ab7f645
CVE: CVE-2024-35935
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: send: handle path ref underflow in header iterate_inode_ref()

Change BUG_ON to proper error handling if building the path buffer
fails. The pointers are not printed so we don't accidentally leak kernel
addresses.
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://git.kernel.org/stable/c/024529c27c8b4b273325a169e078337c8279e229; https://git.kernel.org/stable/c/03938619a1e718b6168ae4528e1b0f979293f1a5; https://git.kernel.org/stable/c/2f6174fd4ccf403b42b3d5f0d1b6b496a0e5330a
CVE: CVE-2024-35936
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()

The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption,
as it could be caused only by two impossible conditions:

- at first the search key is set up to look for a chunk tree item, with
  offset -1, this is an inexact search and the key->offset will contain
  the correct offset upon a successful search, a valid chunk tree item
  cannot have an offset -1

- after first successful search, the found_key corresponds to a chunk
  item, the offset is decremented by 1 before the next loop, it's
  impossible to find a chunk item there due to alignment and size
  constraints
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0d23b34c68c46cd225b55868bc8a269e3134816d; https://git.kernel.org/stable/c/1f9212cdbd005bc55f2b7422e7b560d9c02bd1da; https://git.kernel.org/stable/c/36c2a2863bc3896243eb724dc3fd4cf9aea633f2
CVE: CVE-2024-35937
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: check A-MSDU format more carefully

If it looks like there's another subframe in the A-MSDU
but the header isn't fully there, we can end up reading
data out of bounds, only to discard later. Make this a
bit more careful and check if the subframe header can
even be present.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/16da1e1dac23be45ef6e23c41b1508c400e6c544; https://git.kernel.org/stable/c/5d7a8585fbb31e88fb2a0f581b70667d3300d1e9; https://git.kernel.org/stable/c/9ad[PII_REDACTED]129f190ffbe3beea78460b3b7cc
CVE: CVE-2024-35938
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: decrease MHI channel buffer length to 8KB

Currently buf_len field of ath11k_mhi_config_qca6390 is assigned
with 0, making MHI use a default size, 64KB, to allocate channel
buffers. This is likely to fail in some scenarios where system
memory is highly fragmented and memory compaction or reclaim is
not allowed.

There is a fail report which is caused by it:
kworker/u32:45: page allocation failure: order:4, mode:0x40c00(GFP_NOIO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 19318 Comm: kworker/u32:45 Not tainted 6.8.0-rc3-1.gae4495f-default #1 openSUSE Tumbleweed (unreleased) 493b6d5b382c603654d7a81fc3c144d59a1dfceb
Workqueue: events_unbound async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0x47/0x60
 warn_alloc+0x13a/0x1b0
 ? srso_alias_return_thunk+0x5/0xfbef5
 ? __alloc_pages_direct_compact+0xab/0x210
 __alloc_pages_slowpath.constprop.0+0xd3e/0xda0
 __alloc_pages+0x32d/0x350
 ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814]
 __kmalloc_large_node+0x72/0x110
 __kmalloc+0x37c/0x480
 ? mhi_map_single_no_bb+0x77/0xf0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814]
 ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814]
 mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814]
 __mhi_prepare_for_transfer+0x44/0x80 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814]
 ? __pfx_____mhi_prepare_for_transfer+0x10/0x10 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814]
 device_for_each_child+0x5c/0xa0
 ? __pfx_pci_pm_resume+0x10/0x10
 ath11k_core_resume+0x65/0x100 [ath11k a5094e22d7223135c40d93c8f5321cf09fd85e4e]
 ? srso_alias_return_thunk+0x5/0xfbef5
 ath11k_pci_pm_resume+0x32/0x60 [ath11k_pci 830b7bfc3ea80ebef32e563cafe2cb55e9cc73ec]
 ? srso_alias_return_thunk+0x5/0xfbef5
 dpm_run_callback+0x8c/0x1e0
 device_resume+0x104/0x340
 ? __pfx_dpm_watchdog_handler+0x10/0x10
 async_resume+0x1d/0x30
 async_run_entry_fn+0x32/0x120
 process_one_work+0x168/0x330
 worker_thread+0x2f5/0x410
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xe8/0x120
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x34/0x50
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1b/0x30
 </TASK>

Actually those buffers are used only by QMI target -> host communication.
And for WCN6855 and QCA6390, the largest packet size for that is less
than 6KB. So change buf_len field to 8KB, which results in order 1
allocation if page size is 4KB. In this way, we can at least save some
memory, and as well as decrease the possibility of allocation failure
in those scenarios.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/138fdeac75fb7512a7f9f1c3b236cd2e754af793; https://git.kernel.org/stable/c/1cca1bddf9ef080503c15378cecf4877f7510015; https://git.kernel.org/stable/c/6597a6687af54e2cb58371cf8f6ee4dd85c537de
CVE: CVE-2024-35939
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

dma-direct: Leak pages on dma_set_decrypted() failure

On TDX it is possible for the untrusted host to cause
set_memory_encrypted() or set_memory_decrypted() to fail such that an
error is returned and the resulting memory is shared. Callers need to
take care to handle these errors to avoid returning decrypted (shared)
memory to the page allocator, which could lead to functional or security
issues.

DMA could free decrypted/shared pages if dma_set_decrypted() fails. This
should be a rare case. Just leak the pages in this case instead of
freeing them.
CVSS Score: 7.1 (HIGH)
References: https://git.kernel.org/stable/c/4031b72ca747a1e6e9ae4fa729e765b43363d66a; https://git.kernel.org/stable/c/4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9; https://git.kernel.org/stable/c/b57326c96b7bc7638aa8c44e12afa2defe0c934c
CVE: CVE-2024-35940
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

pstore/zone: Add a null pointer check to the psz_kmsg_read

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure. Ensure the allocation was successful
by checking the pointer validity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0ff96ec22a84d80a18d7ae8ca7eb111c34ee33bb; https://git.kernel.org/stable/c/635594cca59f9d7a8e96187600c34facb8bc0682; https://git.kernel.org/stable/c/6f9f2e498eae7897ba5d3e33908917f68ff4abcc
CVE: CVE-2024-35941
Published: 2024-05-19
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-35942
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain

According to i.MX8MP RM and HDMI ADD, the fdcc clock is part of
hdmi rx verification IP that should not enable for HDMI TX.
But actually if the clock is disabled before HDMI/LCDIF probe,
LCDIF will not get pixel clock from HDMI PHY and print the error
logs:

[CRTC:39:crtc-2] vblank wait timed out
WARNING: CPU: 2 PID: 9 at drivers/gpu/drm/drm_atomic_helper.c:1634 drm_atomic_helper_wait_for_vblanks.part.0+0x23c/0x260

Add fdcc clock to LCDIF and HDMI TX power domains to fix the issue.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/697624ee8ad557ab5417f985d2c804241a7ad30d; https://git.kernel.org/stable/c/9d3f959b426635c4da50dfc7b1306afd84d23e7c; https://git.kernel.org/stable/c/b13c0d871cd878ff53d25507ca535f59ed1f6a2a
CVE: CVE-2024-35943
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

pmdomain: ti: Add a null pointer check to the omap_prm_domain_init

devm_kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure. Ensure the allocation was successful
by checking the pointer validity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/04f23510daa40f9010fadf309507564a34ad956f; https://git.kernel.org/stable/c/5d7f58ee08434a33340f75ac7ac5071eea9673b3; https://git.kernel.org/stable/c/984212fa6b4bc6d9ed58f5b0838e8d5af7679ce5
CVE: CVE-2024-35944
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()

Syzkaller hit 'WARNING in dg_dispatch_as_host' bug.

memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg"
at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24)

WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237
dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237

Some code commentry, based on my understanding:

544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size)
/// This is 24 + payload_size

memcpy(&dg_info->msg, dg, dg_size);
	Destination = dg_info->msg ---> this is a 24 byte
					structure(struct vmci_datagram)
	Source = dg --> this is a 24 byte structure (struct vmci_datagram)
	Size = dg_size = 24 + payload_size

{payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32.

 35 struct delayed_datagram_info {
 36         struct datagram_entry *entry;
 37         struct work_struct work;
 38         bool in_dg_host_queue;
 39         /* msg and msg_payload must be together. */
 40         struct vmci_datagram msg;
 41         u8 msg_payload[];
 42 };

So those extra bytes of payload are copied into msg_payload[], a run time
warning is seen while fuzzing with Syzkaller.

One possible way to fix the warning is to split the memcpy() into
two parts -- one -- direct assignment of msg and second taking care of payload.

Gustavo quoted:
"Under FORTIFY_SOURCE we should not copy data across multiple members
in a structure."
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/130b0cd064874e0d0f58e18fb00e6f3993e90c74; https://git.kernel.org/stable/c/19b070fefd0d024af3daa7329cbc0d00de5302ec; https://git.kernel.org/stable/c/491a1eb07c2bd8841d63cb5263455e185be5866f
CVE: CVE-2024-35945
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

net: phy: phy_device: Prevent nullptr exceptions on ISR

If phydev->irq is set unconditionally, check
for valid interrupt handler or fall back to polling mode to prevent
nullptr exceptions in interrupt service routine.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3419ee39e3d3162ab2ec9942bb537613ed5b6311; https://git.kernel.org/stable/c/61c81872815f46006982bb80460c0c80a949b35b; https://git.kernel.org/stable/c/7a71f61ebf95cedd3f245db6da397822971d8db5
CVE: CVE-2024-35946
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fix null pointer access when abort scan

During cancel scan we might use vif that weren't scanning.
Fix this by using the actual scanning vif.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4f11c741908dab7dd48fa5a986b210d4fc74ca8d; https://git.kernel.org/stable/c/7e11a2966f51695c0af0b1f976a32d64dee243b2; https://git.kernel.org/stable/c/b34d64e9aa5505e3c84570aed5c757f1839573e8
CVE: CVE-2024-35947
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

dyndbg: fix old BUG_ON in >control parser

Fix a BUG_ON from 2009.  Even if it looks "unreachable" (I didn't
really look), lets make sure by removing it, doing pr_err and return
-EINVAL instead.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/00e7d3bea2ce7dac7bee1cf501fb071fd0ea8f6c; https://git.kernel.org/stable/c/343081c21e56bd6690d342e2f5ae8c00183bf081; https://git.kernel.org/stable/c/3c718bddddca9cbef177ac475b94c5c91147fb38
CVE: CVE-2024-5100
Published: 2024-05-19
Description: A vulnerability was found in SourceCodester Simple Inventory System 1.0. It has been classified as critical. This affects an unknown part of the file tableedit.php. The manipulation of the argument from/to leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265083.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-3.md; https://vuldb.com/?ctiid.265083; https://vuldb.com/?id.265083
CVE: CVE-2024-5101
Published: 2024-05-19
Description: A vulnerability was found in SourceCodester Simple Inventory System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file updateproduct.php. The manipulation of the argument ITEM leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265084.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-4.md; https://vuldb.com/?ctiid.265084; https://vuldb.com/?id.265084
CVE: CVE-2024-36053
Published: 2024-05-19
Description: In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_data_received_cb, and Service.remove. A user can modify a service name in a ~/.linuxmint/mintUpload/services/service file.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-20
References: http://packages.linuxmint.com/pool/main/m/mintupload/; https://github.com/linuxmint/mintupload/issues/42; https://github.com/linuxmint/mintupload/issues/43
CVE: CVE-2024-36070
Published: 2024-05-19
Description: tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of getRegistryData in Setup/Frontend/Json.php. (An update is also available for the 2022.11 series.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://github.com/tine-groupware/tine/commit/5d556a1225aa358cbf7cfbeae518c9386b46f516; https://github.com/tine-groupware/tine/releases/tag/2023.11.8; https://github.com/tine-groupware/tine/commit/5d556a1225aa358cbf7cfbeae518c9386b46f516
CVE: CVE-2024-36076
Published: 2024-05-19
Description: Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Syslifters/sysreptor/releases/tag/2024.40; https://github.com/Syslifters/sysreptor/security/advisories/GHSA-2vfc-3h43-vghh; https://github.com/Syslifters/sysreptor/releases/tag/2024.40
CVE: CVE-2024-36078
Published: 2024-05-19
Description: In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes (which run with the environment and permissions of the Zammad user).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-94
References: https://zammad.com/en/advisories/zaa-2024-04; https://zammad.com/en/advisories/zaa-2024-04
CVE: CVE-2024-36080
Published: 2024-05-19
Description: Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed. NOTE: this is a serial-to-Ethernet converter that should not be placed at the edge of the network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.westermo.com/-/media/Files/Cyber-security/westermo_sa_EDW-100_24-05.pdf; https://www.westermo.com/-/media/Files/Cyber-security/westermo_sa_EDW-100_24-05.pdf
CVE: CVE-2024-36081
Published: 2024-05-19
Description: Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. NOTE: this is a serial-to-Ethernet converter that should not be placed at the edge of the network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-256, CWE-522
References: https://www.westermo.com/-/media/Files/Cyber-security/westermo_sa_EDW-100_24-05.pdf; https://www.westermo.com/-/media/Files/Cyber-security/westermo_sa_EDW-100_24-05.pdf
CVE: CVE-2024-5103
Published: 2024-05-19
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/student_first_payment.php. The manipulation of the argument grade leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265093 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%208.pdf; https://vuldb.com/?ctiid.265093; https://vuldb.com/?id.265093
CVE: CVE-2024-5104
Published: 2024-05-19
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/student_grade_wise.php. The manipulation of the argument grade leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265094 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%209.pdf; https://vuldb.com/?ctiid.265094; https://vuldb.com/?id.265094