deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1673
Published: 2024-02-21
Description: Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html; https://issues.chromium.org/issues/41490491; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE: CVE-2024-1674
Published: 2024-02-21
Description: Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html; https://issues.chromium.org/issues/40095183; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE: CVE-2024-1675
Published: 2024-02-21
Description: Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html; https://issues.chromium.org/issues/41486208; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE: CVE-2024-1676
Published: 2024-02-21
Description: Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html; https://issues.chromium.org/issues/40944847; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
CVE: CVE-2024-25151
Published: 2024-02-21
Description: The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151
CVE: CVE-2024-22235
Published: 2024-02-21
Description: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://www.vmware.com/security/advisories/VMSA-2024-0004.html; https://www.vmware.com/security/advisories/VMSA-2024-0004.html
CVE: CVE-2023-42823
Published: 2024-02-21
Description: The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://support.apple.com/en-us/HT213981; https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213983
CVE: CVE-2023-42834
Published: 2024-02-21
Description: A privacy issue was addressed with improved handling of files. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213988
CVE: CVE-2023-42835
Published: 2024-02-21
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1. An attacker may be able to access user data.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213984; https://support.apple.com/kb/HT213984
CVE: CVE-2023-42836
Published: 2024-02-21
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An attacker may be able to access connected network volumes mounted in the home directory.
CVSS Score: 5.3 (MEDIUM)
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT214037
CVE: CVE-2023-42838
Published: 2024-02-21
Description: An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
CVSS Score: 8.6 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT214037; https://support.apple.com/en-us/HT214038
CVE: CVE-2023-42839
Published: 2024-02-21
Description: This issue was addressed with improved state management. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213987
CVE: CVE-2023-42840
Published: 2024-02-21
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://support.apple.com/en-us/HT213983; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213985
CVE: CVE-2023-42843
Published: 2024-02-21
Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: http://www.openwall.com/lists/oss-security/2024/03/26/1; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXLXIOAH5S7J22LJTCIAVFVVJ4TESAX4/; https://support.apple.com/en-us/HT213981
CVE: CVE-2023-42848
Published: 2024-02-21
Description: The issue was addressed with improved bounds checks. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.1. Processing a maliciously crafted image may lead to heap corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://support.apple.com/en-us/HT213981; https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213984
CVE: CVE-2023-42853
Published: 2024-02-21
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2024/Mar/21; https://support.apple.com/en-us/HT213983; https://support.apple.com/en-us/HT213984
CVE: CVE-2023-42855
Published: 2024-02-21
Description: This issue was addressed with improved state management. This issue is fixed in iOS 17.1 and iPadOS 17.1. An attacker with physical access may be able to silently persist an Apple ID on an erased device.
CVSS Score: 4.6 (MEDIUM)
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213982; https://support.apple.com/kb/HT213982
CVE: CVE-2023-42858
Published: 2024-02-21
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213983; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213985
CVE: CVE-2023-42859
Published: 2024-02-21
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/HT213983; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213985
CVE: CVE-2023-42860
Published: 2024-02-21
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://support.apple.com/en-us/HT213983; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213985
CVE: CVE-2023-42873
Published: 2024-02-21
Description: The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.1. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213981; https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213983
CVE: CVE-2023-42877
Published: 2024-02-21
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213983; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213985
CVE: CVE-2023-42878
Published: 2024-02-21
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213988
CVE: CVE-2023-42889
Published: 2024-02-21
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to bypass certain Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-290
References: https://support.apple.com/en-us/HT213983; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213985
CVE: CVE-2023-42928
Published: 2024-02-21
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. An app may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213982; https://support.apple.com/kb/HT213982
CVE: CVE-2023-42939
Published: 2024-02-21
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user's private browsing activity may be unexpectedly saved in the App Privacy Report.
CVSS Score: 3.3 (LOW)
CWE: CWE-841
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213982; https://support.apple.com/kb/HT213982
CVE: CVE-2023-42942
Published: 2024-02-21
Description: This issue was addressed with improved handling of symlinks. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.1. A malicious app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://support.apple.com/en-us/HT213981; https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213984
CVE: CVE-2023-42945
Published: 2024-02-21
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may gain unauthorized access to Bluetooth.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-284
References: https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213984; https://support.apple.com/kb/HT213984
CVE: CVE-2023-42946
Published: 2024-02-21
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to leak sensitive user information.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213987
CVE: CVE-2023-42951
Published: 2024-02-21
Description: The issue was addressed with improved handling of caches. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user may be unable to delete browsing history items.
CVSS Score: 4.3 (MEDIUM)
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213982; https://support.apple.com/kb/HT213982
CVE: CVE-2023-42952
Published: 2024-02-21
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.1. An app with root privileges may be able to access private information.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-269
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213983; https://support.apple.com/en-us/HT213984
CVE: CVE-2023-42953
Published: 2024-02-21
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213984; https://support.apple.com/en-us/HT213987
CVE: CVE-2024-0593
Published: 2024-02-21
Description: The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3038476/simple-job-board/trunk/includes/class-simple-job-board-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a28a161-3dbc-4ef0-a2ce-4c102cf3cbb0?source=cve; https://plugins.trac.wordpress.org/changeset/3038476/simple-job-board/trunk/includes/class-simple-job-board-ajax.php
CVE: CVE-2024-1081
Published: 2024-02-21
Description: The 3D FlipBook – PDF Flipbook WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bookmark feature in all versions up to, and including, 1.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038174%40interactive-3d-flipbook-powered-physics-engine&new=3038174%40interactive-3d-flipbook-powered-physics-engine&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/807eadff-b39e-4d7a-9b0a-06fc18a90626?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038174%40interactive-3d-flipbook-powered-physics-engine&new=3038174%40interactive-3d-flipbook-powered-physics-engine&sfp_email=&sfph_mail=
CVE: CVE-2024-24843
Published: 2024-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a before 2.10.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/powerpack-elements/wordpress-powerpack-pro-for-elementor-plugin-2-10-8-csrf-leading-to-plugin-settings-change-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/powerpack-elements/wordpress-powerpack-pro-for-elementor-plugin-2-10-8-csrf-leading-to-plugin-settings-change-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24849
Published: 2024-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/quicksand-jquery-post-filter/wordpress-quicksand-post-filter-jquery-plugin-3-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quicksand-jquery-post-filter/wordpress-quicksand-post-filter-jquery-plugin-3-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-24872
Published: 2024-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/themify-builder/wordpress-themify-builder-plugin-7-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/themify-builder/wordpress-themify-builder-plugin-7-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-24876
Published: 2024-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/admin-menu-editor/wordpress-admin-menu-editor-plugin-1-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/admin-menu-editor/wordpress-admin-menu-editor-plugin-1-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-25904
Published: 2024-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and TinyMCE Advanced Professsional Formats and Styles: from n/a through 1.1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/tinymce-and-tinymce-advanced-professsional-formats-and-styles/wordpress-tinymce-and-tinymce-advanced-professsional-formats-and-styles-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tinymce-and-tinymce-advanced-professsional-formats-and-styles/wordpress-tinymce-and-tinymce-advanced-professsional-formats-and-styles-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-25905
Published: 2024-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form.This issue affects Multi Step Form: from n/a through 1.7.18.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/multi-step-form/wordpress-multi-step-form-plugin-1-7-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/multi-step-form/wordpress-multi-step-form-plugin-1-7-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-52440
Published: 2024-02-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

If authblob->SessionKey.Length is bigger than session key
size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes.
cifs_arc4_crypt copy to session key array from SessionKey from client.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://git.kernel.org/stable/c/30fd6521b2fbd9b767e438e31945e5ea3e3a2fba; https://git.kernel.org/stable/c/4b081ce0d830b684fdf967abc3696d[PII_REDACTED]; https://git.kernel.org/stable/c/7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4
CVE: CVE-2023-52441
Published: 2024-02-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix out of bounds in init_smb2_rsp_hdr()

If client send smb2 negotiate request and then send smb1 negotiate
request, init_smb2_rsp_hdr is called for smb1 negotiate request since
need_neg is set to false. This patch ignore smb1 packets after ->need_neg
is set to false.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc; https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b; https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b
CVE: CVE-2023-52442
Published: 2024-02-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate session id and tree id in compound request

`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session()
will always return the first request smb2 header in a compound request.
if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will
return 0, i.e. The tree id check is skipped.
This patch use ksmbd_req_buf_next() to get current command in compound.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693; https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e; https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac
CVE: CVE-2024-24798
Published: 2024-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/debug/wordpress-debug-plugin-1-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/debug/wordpress-debug-plugin-1-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-24802
Published: 2024-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/jtrt-responsive-tables/wordpress-jtrt-responsive-tables-plugin-4-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jtrt-responsive-tables/wordpress-jtrt-responsive-tables-plugin-4-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve