deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56758
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: check folio mapping after unlock in relocate_one_folio()

When we call btrfs_read_folio() to bring a folio uptodate, we unlock the
folio. The result of that is that a different thread can modify the
mapping (like remove it with invalidate) before we call folio_lock().
This results in an invalid page and we need to try again.

In particular, if we are relocating concurrently with aborting a
transaction, this can result in a crash like the following:

  BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP
  CPU: 76 PID: 1411631 Comm: kworker/u322:5
  Workqueue: events_unbound btrfs_reclaim_bgs_work
  RIP: 0010:set_page_extent_mapped+0x20/0xb0
  RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246
  RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: [PII_REDACTED]
  RDX: [PII_REDACTED] RSI: ffffc900516a7b90 RDI: ffffea009e0b1880
  RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: ffff88c07fd2f3f0
  R10: [PII_REDACTED] R11:[PII_REDACTED]b575be R12: [PII_REDACTED]
  R13:[PII_REDACTED]572fff R14:[PII_REDACTED]100cca R15:[PII_REDACTED]582fff
  FS:  [PII_REDACTED](0000) GS:ffff88c07fd00000(0000) knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2: [PII_REDACTED] CR3: 000000407d00f002 CR4:[PII_REDACTED]7706f0
  DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
  DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
  PKRU: 55555554
  Call Trace:
  <TASK>
  ? __die+0x78/0xc0
  ? page_fault_oops+0x2a8/0x3a0
  ? __switch_to+0x133/0x530
  ? wq_worker_running+0xa/0x40
  ? exc_page_fault+0x63/0x130
  ? asm_exc_page_fault+0x22/0x30
  ? set_page_extent_mapped+0x20/0xb0
  relocate_file_extent_cluster+0x1a7/0x940
  relocate_data_extent+0xaf/0x120
  relocate_block_group+0x20f/0x480
  btrfs_relocate_block_group+0x152/0x320
  btrfs_relocate_chunk+0x3d/0x120
  btrfs_reclaim_bgs_work+0x2ae/0x4e0
  process_scheduled_works+0x184/0x370
  worker_thread+0xc6/0x3e0
  ? blk_add_timer+0xb0/0xb0
  kthread+0xae/0xe0
  ? flush_tlb_kernel_range+0x90/0x90
  ret_from_fork+0x2f/0x40
  ? flush_tlb_kernel_range+0x90/0x90
  ret_from_fork_asm+0x11/0x20
  </TASK>

This occurs because cleanup_one_transaction() calls
destroy_delalloc_inodes() which calls invalidate_inode_pages2() which
takes the folio_lock before setting mapping to NULL. We fail to check
this, and subsequently call set_extent_mapping(), which assumes that
mapping != NULL (in fact it asserts that in debug mode)

Note that the "fixes" patch here is not the one that introduced the
race (the very first iteration of this code from 2009) but a more recent
change that made this particular crash happen in practice.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/36679fab54fa7bcffafd469e2c474c1fc4beaee0; https://git.kernel.org/stable/c/3e74859ee35edc33a022c3f3971df066ea0ca6b9; https://git.kernel.org/stable/c/c7b1bd52a031ad0144d42eef0ba8471ce75122dd
CVE: CVE-2024-56759
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free when COWing tree bock and tracing is enabled

When a COWing a tree block, at btrfs_cow_block(), and we have the
tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled
(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent
buffer while inside the tracepoint code. This is because in some paths
that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding
the last reference on the extent buffer @buf so btrfs_force_cow_block()
drops the last reference on the @buf extent buffer when it calls
free_extent_buffer_stale(buf), which schedules the release of the extent
buffer with RCU. This means that if we are on a kernel with preemption,
the current task may be preempted before calling trace_btrfs_cow_block()
and the extent buffer already released by the time trace_btrfs_cow_block()
is called, resulting in a use-after-free.

Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to
btrfs_force_cow_block() before the COWed extent buffer is freed.
This also has a side effect of invoking the tracepoint in the tree defrag
code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is
called there, but this is fine and it was actually missing there.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/44f52bbe96dfdbe4aca3818a[PII_REDACTED]a07040; https://git.kernel.org/stable/c/526ff5b27f090fb15040471f892cd2c9899ce314; https://git.kernel.org/stable/c/66376f1a73cba57fd0af2631d7888605b738e499
CVE: CVE-2024-56760
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI/MSI: Handle lack of irqdomain gracefully

Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a
RISCV platform which does not provide PCI/MSI support:

 WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32
 __pci_enable_msix_range+0x30c/0x596
 pci_msi_setup_msi_irqs+0x2c/0x32
 pci_alloc_irq_vectors_affinity+0xb8/0xe2

RISCV uses hierarchical interrupt domains and correctly does not implement
the legacy fallback. The warning triggers from the legacy fallback stub.

That warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent
domain is associated with the device or not. There is a check for MSI-X,
which has a legacy assumption. But that legacy fallback assumption is only
valid when legacy support is enabled, but otherwise the check should simply
return -ENOTSUPP.

Loongarch tripped over the same problem and blindly enabled legacy support
without implementing the legacy fallbacks. There are weak implementations
which return an error, so the problem was papered over.

Correct pci_msi_domain_supports() to evaluate the legacy mode and add
the missing supported check into the MSI enable path to complete it.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/a60b990798eb17433d[PII_REDACTED]422b1bd94b18; https://git.kernel.org/stable/c/aed157301c659a48f5564cc4568cf0e5c8831af0; https://git.kernel.org/stable/c/b1f7476e07b93d65a1a3643dcb4a7bed80d4328d
CVE: CVE-2024-56761
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/fred: Clear WFE in missing-ENDBRANCH #CPs

An indirect branch instruction sets the CPU indirect branch tracker
(IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted
across the instruction boundary.  When the decoder finds an
inappropriate instruction while WFE is set ENDBR, the CPU raises a #CP
fault.

For the "kernel IBT no ENDBR" selftest where #CPs are deliberately
triggered, the WFE state of the interrupted context needs to be
cleared to let execution continue.  Otherwise when the CPU resumes
from the instruction that just caused the previous #CP, another
missing-ENDBRANCH #CP is raised and the CPU enters a dead loop.

This is not a problem with IDT because it doesn't preserve WFE and
IRET doesn't set WFE.  But FRED provides space on the entry stack
(in an expanded CS area) to save and restore the WFE state, thus the
WFE state is no longer clobbered, so software must clear it.

Clear WFE to avoid dead looping in ibt_clear_fred_wfe() and the
!ibt_fatal code path when execution is allowed to continue.

Clobbering WFE in any other circumstance is a security-relevant bug.

[ dhansen: changelog rewording ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/151447859d6fb0dcce8259f0971c6e94fb801661; https://git.kernel.org/stable/c/b939f108e86b76119428a6fa4e92491e09ac7867; https://git.kernel.org/stable/c/dc81e556f2a017d681251ace21bf06c126d5a192
CVE: CVE-2024-56762
Published: 2025-01-06
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-56763
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

tracing: Prevent bad count for tracing_cpumask_write

If a large count is provided, it will trigger a warning in bitmap_parse_user.
Also check zero for it.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/03041e474a6a8f1bfd4b96b164bb3165c48fa1a3; https://git.kernel.org/stable/c/1cca920af19df5dd91254e5ff35e68e911683706; https://git.kernel.org/stable/c/2558d753df0628d4187d8e1fd989339460f4f364
CVE: CVE-2024-56764
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

ublk: detach gendisk from ublk device if add_disk() fails

Inside ublk_abort_requests(), gendisk is grabbed for aborting all
inflight requests. And ublk_abort_requests() is called when exiting
the uring context or handling timeout.

If add_disk() fails, the gendisk may have been freed when calling
ublk_abort_requests(), so use-after-free can be caused when getting
disk's reference in ublk_abort_requests().

Fixes the bug by detaching gendisk from ublk device if add_disk() fails.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/75cd4005da[PII_REDACTED]a4a4ee45e[PII_REDACTED]4; https://git.kernel.org/stable/c/7d680f2f76a3417fdfc3946da7471e81464f7b41
CVE: CVE-2024-56766
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: fix double free in atmel_pmecc_create_user()

The "user" pointer was converted from being allocated with kzalloc() to
being allocated by devm_kzalloc().  Calling kfree(user) will lead to a
double free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/1562871ef613fa9492aa0310933eff785166a90e; https://git.kernel.org/stable/c/3d825a241e65f7e[PII_REDACTED]e79d735ec40b80e; https://git.kernel.org/stable/c/6ea15205d7e2b811fbbdf79783f686f58abfb4b7
CVE: CVE-2024-56767
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset

The at_xdmac_memset_create_desc may return NULL, which will lead to a
null pointer dereference. For example, the len input is error, or the
atchan->free_descs_list is empty and memory is exhausted. Therefore, add
check to avoid this.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3d229600c54e9e0909080ecaf1aab0642aefa5f0; https://git.kernel.org/stable/c/54376d8d26596f98ed7432a788314bb9154bf3e3; https://git.kernel.org/stable/c/8d364597de9ce2a5f52714224bfe6c2e7a29b303
CVE: CVE-2024-56768
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP

On x86-64 calling bpf_get_smp_processor_id() in a kernel with CONFIG_SMP
disabled can trigger the following bug, as pcpu_hot is unavailable:

 [    8.471774] BUG: unable to handle page fault for address:[PII_REDACTED]6a290c
 [    8.471849] #PF: supervisor read access in kernel mode
 [    8.471881] #PF: error_code(0x0000) - not-present page

Fix by inlining a return 0 in the !CONFIG_SMP case.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/23579010cf0a12476e96a5f1acdf78a9c5843657; https://git.kernel.org/stable/c/f4ab7d74247b0150547cf909b3f6f24ee85183df
CVE: CVE-2024-56769
Published: 2025-01-06
Description: In the Linux kernel, the following vulnerability has been resolved:

media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg

Syzbot reports [1] an uninitialized value issue found by KMSAN in
dib3000_read_reg().

Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case
that call fails, the buffer may end up with some undefined values.

Since no elaborate error handling is expected in dib3000_write_reg(),
simply zero out rb buffer to mitigate the problem.

[1] Syzkaller report
dvb-usb: bulk message failed: -22 (6/0)
=====================================================
BUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758
 dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758
 dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31
 dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290
 dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline]
 dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline]
 dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310
 dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110
...
Local variable rb created at:
 dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54
 dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758
...
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/035772fcd631eee2756b31cb6df249c0a8d453d7; https://git.kernel.org/stable/c/1d6de21f00293d819b5ca6dbe75ff1f3b6392140; https://git.kernel.org/stable/c/2dd59fe0e19e1ab[PII_REDACTED]82b62e5751924c7
CVE: CVE-2025-21613
Published: 2025-01-06
Description: go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88, CWE-88
References: https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m
CVE: CVE-2025-21614
Published: 2025-01-06
Description: go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4
CVE: CVE-2025-21615
Published: 2025-01-06
Description: AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/bailuk/AAT/security/advisories/GHSA-pwpm-x58v-px5c
CVE: CVE-2025-21618
Published: 2025-01-06
Description: NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/zauberzeug/nicegui/commit/1621a4ba6a06676b8094362d36623551e651adc1; https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v6jv-p6r8-j78w
CVE: CVE-2024-46073
Published: 2025-01-06
Description: A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanitization of the "next" parameter, which is included in the application's response without adequate escaping. An attacker can exploit this flaw by tricking a user into visiting a specially crafted URL, causing the execution of arbitrary JavaScript code in the context of the victim's browser. The issue occurs even though the application has sanitization mechanisms in place.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gamonoid/icehrm; https://github.com/manisashank/CVE-Publish/blob/main/CVE-2024-46073.md
CVE: CVE-2024-46622
Published: 2025-01-06
Description: An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18, and 8.1.x before 8.1.18 that allows arbitrary file creation, modification and deletion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281
References: https://www.secureage.com/; https://www.secureage.com/blog/resolved-escalation-of-privilege
CVE: CVE-2024-54879
Published: 2025-01-06
Description: SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-281
References: http://seacms.com; https://blog.csdn.net/weixin_46686336/article/details/144797242
CVE: CVE-2024-54880
Published: 2025-01-06
Description: SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-281
References: https://blog.csdn.net/weixin_46686336/article/details/144797063; https://www.seacms.net/
CVE: CVE-2024-55529
Published: 2025-01-06
Description: Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/fengyijiu520/Z-Blog-
CVE: CVE-2024-55626
Published: 2025-01-06
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large BPF filter file provided to Suricata at startup can lead to a buffer overflow at Suricata startup. The issue has been addressed in Suricata 7.0.8.
CVSS Score: 3.3 (LOW)
CWE: CWE-680
References: https://github.com/OISF/suricata/commit/dd71ef0af222a566e54dfc479dd1951dd17d7ceb; https://github.com/OISF/suricata/security/advisories/GHSA-wmg4-jqx5-4h9v; https://redmine.openinfosecfoundation.org/issues/7366
CVE: CVE-2024-55627
Published: 2025-01-06
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a specially crafted TCP stream can lead to a very large buffer overflow while being zero-filled during initialization with memset due to an unsigned integer underflow. The issue has been addressed in Suricata 7.0.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-122, CWE-191, CWE-787
References: https://github.com/OISF/suricata/commit/282509f70c4ce805098e59535af445362e3e9ebd; https://github.com/OISF/suricata/commit/[PII_REDACTED]dbb5f9584edae994af2100733fb4be; https://github.com/OISF/suricata/commit/9a53ec43b13f0039a083950511a18bf6f408e432
CVE: CVE-2024-55628
Published: 2025-01-06
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8, DNS resource name compression can lead to small DNS messages containing very large hostnames which can be costly to decode, and lead to very large DNS log records. While there are limits in place, they were too generous. The issue has been addressed in Suricata 7.0.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-405, CWE-779
References: https://github.com/OISF/suricata/commit/19cf0f81335d9f787d587450f7105ad95a648951; https://github.com/OISF/suricata/commit/37f4c52b22fcdde4adf9b479cb5700f89d00768d; https://github.com/OISF/suricata/commit/3a5671739f5b25e5dd973a74ca5fd8ea40e1ae2d
CVE: CVE-2024-55629
Published: 2025-01-06
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urgent data (out of band data) can lead to Suricata analyzing data differently than the applications at the TCP endpoints, leading to possible evasions. Suricata 7.0.8 includes options to allow users to configure how to handle TCP urgent data. In IPS mode, you can use a rule such as drop tcp any any -> any any (sid:1; tcp.flags:U*;) to drop all the packets with urgent flag set.
CVSS Score: 7.5 (HIGH)
CWE: CWE-437, CWE-436
References: https://github.com/OISF/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7; https://github.com/OISF/suricata/commit/779f9d8ba35c3f9b5abfa327d3a4209861bd2eb8; https://github.com/OISF/suricata/security/advisories/GHSA-69wr-vhwg-84h2
CVE: CVE-2024-56828
Published: 2025-01-06
Description: File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the base64-encoded image is parsed. For example, given a string like: data:image/html;base64,PGh0bWw+PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPjwvaHRtbD4= the content after the comma is extracted and decoded using Base64.getDecoder().decode(). The substring from the 11th character up to the first occurrence of a semicolon (;) is assigned to the suffix variable (representing the file extension). The decoded content is then written to a file. However, the file extension is not validated, and since this functionality is exposed to the frontend, it poses significant security risks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gitee.com/liweiyi/ChestnutCMS; https://github.com/Zerone0x00/CVE/blob/main/ChestnutCMS/CVE-2024-56828.md; https://www.1000mz.com/
CVE: CVE-2024-35498
Published: 2025-01-06
Description: A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/r4vanan/Stored-xss-Grav-v1.7.45; https://r4vanan.medium.com/a-quick-dive-into-xss-vulnerability-in-grav-cms-v1-7-45-cve-2024-35498-fc236b7d74a0
CVE: CVE-2024-46209
Published: 2025-01-06
Description: A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/h4ckr4v3n/CVE-2024-46209/blob/main/REDAXO%20Stored%20XSS%20%2B%20RCE.pdf; https://github.com/h4ckr4v3n/research_redaxo_5_17_1.git
CVE: CVE-2024-55407
Published: 2025-01-06
Description: An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplying crafted IOCTL requests.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: http://ite.com; https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55407/CVE-2024-55407_Winio64.sys_README.md
CVE: CVE-2024-55408
Published: 2025-01-06
Description: An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL requests are supplied.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55408/CVE-2024-55408_AsusSAIO.sys_README.md; https://www.asus.com/tw/support/myasus-deeplink/
CVE: CVE-2024-55074
Published: 2025-01-06
Description: The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/; https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/
CVE: CVE-2025-21617
Published: 2025-01-06
Description: Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
CWE: CWE-338
References: https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192; https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53; https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1