deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12368
Published: 2025-02-25
Description: Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/193854
CVE: CVE-2025-23046
Published: 2025-02-25
Description: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-303
References: https://github.com/glpi-project/glpi/releases/tag/10.0.18; https://github.com/glpi-project/glpi/security/advisories/GHSA-vfxc-qg3v-j2r5
CVE: CVE-2025-25192
Published: 2025-02-25
Description: GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/glpi-project/glpi/releases/tag/10.0.18; https://github.com/glpi-project/glpi/security/advisories/GHSA-86cx-hcfc-8mm8; https://www.vicarius.io/vsociety/posts/cve-2025-25192-detection-glpi-vulnerability
CVE: CVE-2024-36259
Published: 2025-02-25
Description: Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/199330
CVE: CVE-2025-27135
Published: 2025-02-25
Description: RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/infiniflow/ragflow/blob/v0.15.1/agent/component/exesql.py; https://github.com/infiniflow/ragflow/security/advisories/GHSA-3gqj-66qm-25jq; https://swizzky.notion.site/ragflow-exesql-150ca6df7c03806989cefde915cf8e42?pvs=4
CVE: CVE-2024-45417
Published: 2025-02-25
Description: Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of information via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-708
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24039/
CVE: CVE-2024-45418
Published: 2025-02-25
Description: Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-61, CWE-59
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24040/
CVE: CVE-2024-45421
Published: 2025-02-25
Description: Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.
CVSS Score: 8.5 (HIGH)
CWE: CWE-122, CWE-119
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24043/
CVE: CVE-2024-45424
Published: 2025-02-25
Description: Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-840
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24036/
CVE: CVE-2024-45425
Published: 2025-02-25
Description: Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-286
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24037/
CVE: CVE-2024-45426
Published: 2025-02-25
Description: Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-708
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24038/
CVE: CVE-2025-27110
Published: 2025-02-25
Description: Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-172
References: https://github.com/owasp-modsecurity/ModSecurity/issues/3340; https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-42w7-rmv5-4x2j
CVE: CVE-2025-27139
Published: 2025-02-25
Description: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences page is opened. Versions 2.7.12, 3.1.2, and 3.2.0 fix the issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-c6mg-9537-c8cf
CVE: CVE-2025-27142
Published: 2025-02-25
Description: LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the `POST /api/localsend/v2/prepare-upload` and the `POST /api/localsend/v2/upload` endpoint, a malicious file transfer request can write files to the arbitrary location on the system, resulting in the remote command execution. A malicious file transfer request sent by nearby devices can write files into an arbitrary directory. This usually allows command execution via the startup folder on Windows or Bash-related files on Linux. If the user enables the `Quick Save` feature, it will silently write files without explicit user interaction. Version 1.17.0 fixes this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/localsend/localsend/commit/e8635204ec782ded45bc7d698deb60f3c4105687; https://github.com/localsend/localsend/security/advisories/GHSA-f7jp-p6j4-3522
CVE: CVE-2025-27146
Published: 2025-02-25
Description: matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
CVSS Score: 2.7 (LOW)
CWE: CWE-77, CWE-88, CWE-77
References: https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd; https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-5mvm-89c9-9gm5
CVE: CVE-2024-0148
Published: 2025-02-25
Description: NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the device could load untrusted code. A successful exploit might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. The scope of the impacts can extend to other components.
CVSS Score: 7.6 (HIGH)
CWE: CWE-447
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5617
CVE: CVE-2024-27239
Published: 2025-02-25
Description: Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24018/
CVE: CVE-2024-27245
Published: 2025-02-25
Description: Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-122
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24016/
CVE: CVE-2024-27246
Published: 2025-02-25
Description: Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24017/
CVE: CVE-2024-53870
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53871
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53872
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53873
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for Windows contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53874
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53875
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53876
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53877
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53878
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 2.8 (LOW)
CWE: CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2024-53879
Published: 2025-02-25
Description: NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS Score: 2.8 (LOW)
CWE: CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5594
CVE: CVE-2025-27148
Published: 2025-02-25
Description: Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28 could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.

In net.rubygrapefruit:native-platform prior to version 0.22-milestone-28, if the `Native.get(Class<>)` method was called, without calling `Native.init(File)` first, with a non-`null` argument used as working file path, then the library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 78. Version 0.22-milestone-28 has been released with changes that fix the problem. Initialization is now mandatory and no longer uses the system temporary directory, unless such a path is passed for initialization. The only workaround for affected versions is to make sure to do a proper initialization, using a location that is safe.

Gradle 8.12, only that exact version, had codepaths where the initialization of the underlying native integration library took a default path, relying on copying the binaries to the system temporary directory. Any execution of Gradle exposed this exploit. Users of Windows or modern versions of macOS are not vulnerable, nor are users of a Unix-like operating system with the "sticky" bit set or `noexec` on their system temporary directory vulnerable. This problem was fixed in Gradle 8.12.1. Gradle 8.13 release also upgrades to a version of the native library that no longer has that bug. Some workarounds are available. On Unix-like operating systems, ensure that the "sticky" bit is set. This only allows the original user (or root) to delete a file. Mounting `/tmp` as `noexec` will prevent Gradle 8.12 from starting. Those who are are unable to change the permissions of the system temporary directory can move the Java temporary directory by setting the System Property java.io.tmpdir. The new path needs to limit permissions to the build user only.
CVSS Score: 8.8 (HIGH)
CWE: CWE-378, CWE-379
References: https://en.wikipedia.org/wiki/Fstab#Options_common_to_all_filesystems; https://en.wikipedia.org/wiki/Sticky_bit; https://github.com/gradle/gradle/pull/32025
CVE: CVE-2025-0514
Published: 2025-02-25
Description: Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink  targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.libreoffice.org/about-us/security/advisories/cve-2025-0514
CVE: CVE-2025-22211
Published: 2025-02-25
Description: A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend.
CVSS Score: 3.4 (LOW)
CWE: CWE-89, CWE-89
References: https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22211; https://www.webdesigner-profi.de/
CVE: CVE-2025-25514
Published: 2025-02-25
Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-6.md
CVE: CVE-2025-25515
Published: 2025-02-25
Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-5.md
CVE: CVE-2025-25516
Published: 2025-02-25
Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-2.md
CVE: CVE-2025-25517
Published: 2025-02-25
Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-7.md
CVE: CVE-2025-25519
Published: 2025-02-25
Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-8.md
CVE: CVE-2025-25520
Published: 2025-02-25
Description: Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-4.md
CVE: CVE-2025-25521
Published: 2025-02-25
Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-3.md
CVE: CVE-2024-30150
Published: 2025-02-25
Description: HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery (SSRF) and Denial of Service(DOS) attacks from unauthenticated users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269, CWE-918
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119368
CVE: CVE-2025-0760
Published: 2025-02-26
Description: A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption.
CVSS Score: 2.7 (LOW)
CWE: CWE-522
References: https://www.tenable.com/security/tns-2025-01
CVE: CVE-2025-1091
Published: 2025-02-26
Description: A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.tenable.com/security/tns-2025-01
CVE: CVE-2021-47631
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: davinci: da850-evm: Avoid NULL pointer dereference

With newer versions of GCC, there is a panic in da850_evm_config_emac()
when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine:

Unable to handle kernel NULL pointer dereference at virtual address 00000020
pgd = (ptrval)
[00000020] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT ARM
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1
Hardware name: Generic DT based system
PC is at da850_evm_config_emac+0x1c/0x120
LR is at do_one_initcall+0x50/0x1e0

The emac_pdata pointer in soc_info is NULL because davinci_soc_info only
gets populated on davinci machines but da850_evm_config_emac() is called
on all machines via device_initcall().

Move the rmii_en assignment below the machine check so that it is only
dereferenced when running on a supported SoC.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0940795c6834fbe7705acc5c3d4b2f7a5f67527a; https://git.kernel.org/stable/c/0a312ec66a03133d28570f07bc52749ccfef54da; https://git.kernel.org/stable/c/83a1cde5c74bfb44b49cb2a940d044bb2380f4ea
CVE: CVE-2021-47632
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/set_memory: Avoid spinlock recursion in change_page_attr()

Commit 1f9ad21c3b38 ("powerpc/mm: Implement set_memory() routines")
included a spin_lock() to change_page_attr() in order to
safely perform the three step operations. But then
commit 9f7853d7609d ("powerpc/mm: Fix set_memory_*() against
concurrent accesses") modify it to use pte_update() and do
the operation safely against concurrent access.

In the meantime, Maxime reported some spinlock recursion.

[   15.351649] BUG: spinlock recursion on CPU#0, kworker/0:2/217
[   15.357540]  lock: init_mm+0x3c/0x420, .magic: dead4ead, .owner: kworker/0:2/217, .owner_cpu: 0
[   15.366563] CPU: 0 PID: 217 Comm: kworker/0:2 Not tainted 5.15.0+ #523
[   15.373350] Workqueue: events do_free_init
[   15.377615] Call Trace:
[   15.380232] [e4105ac0] [800946a4] do_raw_spin_lock+0xf8/0x120 (unreliable)
[   15.387340] [e4105ae0] [8001f4ec] change_page_attr+0x40/0x1d4
[   15.393413] [e4105b10] [801424e0] __apply_to_page_range+0x164/0x310
[   15.400009] [e4105b60] [80169620] free_pcp_prepare+0x1e4/0x4a0
[   15.406045] [e4105ba0] [8016c5a0] free_unref_page+0x40/0x2b8
[   15.411979] [e4105be0] [8018724c] kasan_depopulate_vmalloc_pte+0x6c/0x94
[   15.418989] [e4105c00] [801424e0] __apply_to_page_range+0x164/0x310
[   15.425451] [e4105c50] [80187834] kasan_release_vmalloc+0xbc/0x134
[   15.431898] [e4105c70] [8015f7a8] __purge_vmap_area_lazy+0x4e4/0xdd8
[   15.438560] [e4105d30] [80160d10] _vm_unmap_aliases.part.0+0x17c/0x24c
[   15.445283] [e4105d60] [801642d0] __vunmap+0x2f0/0x5c8
[   15.450684] [e4105db0] [800e32d0] do_free_init+0x68/0x94
[   15.456181] [e4105dd0] [8005d094] process_one_work+0x4bc/0x7b8
[   15.462283] [e4105e90] [8005d614] worker_thread+0x284/0x6e8
[   15.468227] [e4105f00] [8006aaec] kthread+0x1f0/0x210
[   15.473489] [e4105f40] [80017148] ret_from_kernel_thread+0x14/0x1c

Remove the read / modify / write sequence to make the operation atomic
and remove the spin_lock() in change_page_attr().

To do the operation atomically, we can't use pte modification helpers
anymore. Because all platforms have different combination of bits, it
is not easy to use those bits directly. But all have the
_PAGE_KERNEL_{RO/ROX/RW/RWX} set of flags. All we need it to compare
two sets to know which bits are set or cleared.

For instance, by comparing _PAGE_KERNEL_ROX and _PAGE_KERNEL_RO you
know which bit gets cleared and which bit get set when changing exec
permission.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/6def4eaf0391f24be541633a954c0e4876858b1e; https://git.kernel.org/stable/c/6ebe5ca2cbe438a688f2ae238ef5a0b0b5f3468a; https://git.kernel.org/stable/c/96917107e67846f1d959ed03be281048efad14c5