deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41219
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to `nullptr`. This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/e6cf28c72ba2eb949ca950d834dd6d66bb01cfae; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4f99-p9c2-3j8x; https://github.com/tensorflow/tensorflow/commit/e6cf28c72ba2eb949ca950d834dd6d66bb01cfae
CVE: CVE-2021-41223
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr; https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda
CVE: CVE-2021-41224
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to trigger a heap OOB access. This occurs whenever the size of `indices` does not match the size of `values`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rg3m-hqc5-344v; https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b
CVE: CVE-2021-41226
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/f410212e373eb2aec4c9e60bf3702eba99a38aba; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-374m-jm66-3vj8; https://github.com/tensorflow/tensorflow/commit/f410212e373eb2aec4c9e60bf3702eba99a38aba
CVE: CVE-2021-42359
Published: 2021-11-05
Description: WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-862
References: https://www.wordfence.com/blog/2021/11/vulnerability-in-wp-dsgvo-tools-gdpr-plugin-allows-unauthenticated-page-deletion/; https://www.wordfence.com/blog/2021/11/vulnerability-in-wp-dsgvo-tools-gdpr-plugin-allows-unauthenticated-page-deletion/
CVE: CVE-2021-41202
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-681
References: https://github.com/tensorflow/tensorflow/commit/1b0e0ec27e7895b9985076eab32445026ae5ca94; https://github.com/tensorflow/tensorflow/commit/6d94002a09711d297dbba90390d5482b76113899; https://github.com/tensorflow/tensorflow/issues/46889
CVE: CVE-2021-41206
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.0 (HIGH)
CWE: CWE-354
References: https://github.com/tensorflow/tensorflow/commit/4d74d8a00b07441cba090a02e0dd9ed385145bf4; https://github.com/tensorflow/tensorflow/commit/4dddb2fd0b01cdd196101afbba6518658a2c9e07; https://github.com/tensorflow/tensorflow/commit/579261dcd446385831fe4f7457d802a59685121d
CVE: CVE-2021-41207
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `ParallelConcat` misses some input validation and can produce a division by 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7v94-64hj-m82h; https://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235
CVE: CVE-2021-41208
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures) as well as abuse undefined behavior (binding references to `nullptr`s). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call. Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. We will deprecate TensorFlow's boosted trees APIs in subsequent releases. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476, CWE-824, CWE-476
References: https://github.com/tensorflow/tensorflow/commit/5c8c9a8bfe750f9743d0c859bae112060b216f5c; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-57wx-m983-2f88; https://github.com/tensorflow/tensorflow/commit/5c8c9a8bfe750f9743d0c859bae112060b216f5c
CVE: CVE-2021-41209
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6hpv-v2rx-c5g6; https://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235
CVE: CVE-2021-41218
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0. This occurs whenever the `split_count` argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/commit/a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9crf-c6qr-r273; https://github.com/tensorflow/tensorflow/commit/a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc
CVE: CVE-2020-22222
Published: 2021-11-05
Description: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionLoadCss function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/cZFwMb5F; https://pastebin.com/cZFwMb5F
CVE: CVE-2020-22223
Published: 2021-11-05
Description: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoad function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://pastebin.com/cZFwMb5F; https://pastebin.com/cZFwMb5F
CVE: CVE-2020-22224
Published: 2021-11-05
Description: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionPreview function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/cZFwMb5F; https://pastebin.com/cZFwMb5F
CVE: CVE-2020-22225
Published: 2021-11-05
Description: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoadForm function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://pastebin.com/cZFwMb5F; https://pastebin.com/cZFwMb5F
CVE: CVE-2020-22226
Published: 2021-11-05
Description: Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionSetAmount function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://pastebin.com/cZFwMb5F; https://pastebin.com/cZFwMb5F
CVE: CVE-2021-41213
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock` Python object. Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive `tf.function`, although this is not a frequent scenario. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-662
References: https://github.com/tensorflow/tensorflow/commit/afac8158d43691661ad083f6dd9e56f327c1dcb7; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h67m-xg8f-fxcf; https://github.com/tensorflow/tensorflow/commit/afac8158d43691661ad083f6dd9e56f327c1dcb7
CVE: CVE-2021-41216
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for `Transpose` is vulnerable to a heap buffer overflow. This occurs whenever `perm` contains negative elements. The shape inference function does not validate that the indices in `perm` are all valid. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://github.com/tensorflow/tensorflow/commit/c79ba87153ee343401dbe9d1954d7f79e521eb14; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3ff2-r28g-w7h9; https://github.com/tensorflow/tensorflow/commit/c79ba87153ee343401dbe9d1954d7f79e521eb14
CVE: CVE-2021-41220
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5; https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75
CVE: CVE-2021-41221
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://github.com/tensorflow/tensorflow/commit/af5fcebb37c8b5d71c237f4e59c6477015c78ce6; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cqv6-3phm-hcwx; https://github.com/tensorflow/tensorflow/commit/af5fcebb37c8b5d71c237f4e59c6477015c78ce6
CVE: CVE-2021-41222
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-682
References: https://github.com/tensorflow/tensorflow/commit/25d622ffc432acc736b14ca[PII_REDACTED]e733cc6; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cpf4-wx82-gxp6; https://github.com/tensorflow/tensorflow/commit/25d622ffc432acc736b14ca[PII_REDACTED]e733cc6
CVE: CVE-2021-41225
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7r94-xv9v-63jw; https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3
CVE: CVE-2021-41227
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the `tstring` TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/1cb6bb6c2a6019417c9adaf9e6843ba75ee2580b; https://github.com/tensorflow/tensorflow/commit/3712a2d3455e6ccb924daa5724a3652a86f6b585; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j8c8-67vp-6mx7
CVE: CVE-2021-41228
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-94
References: https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3rcw-9p9x-582v; https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7
CVE: CVE-2021-41230
Published: 2021-11-05
Description: Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/pomerium/pomerium/pull/2724; https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfg; https://github.com/pomerium/pomerium/pull/2724
CVE: CVE-2021-41250
Published: 2021-11-05
Description: Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit[PII_REDACTED]2513d13e0213870e50fb3cff1424e0
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/python-discord/bot/commit/[PII_REDACTED]2513d13e0213870e50fb3cff1424e0; https://github.com/python-discord/bot/security/advisories/GHSA-j8c3-8x46-8pp6; https://github.com/python-discord/bot/commit/[PII_REDACTED]2513d13e0213870e50fb3cff1424e0
CVE: CVE-2021-41251
Published: 2021-11-05
Description: @sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions. By default, destination caching is disabled. The security for caching has been increased. The changes are released in version 1.52.0. Users unable to upgrade are advised to disable destination caching (it is disabled by default).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/SAP/cloud-sdk-js/pull/1769; https://github.com/SAP/cloud-sdk-js/pull/1770; https://github.com/SAP/cloud-sdk-js/security/advisories/GHSA-gp2f-254m-rh32
CVE: CVE-2020-23129
Published: 2021-11-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-23130
Published: 2021-11-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-37471
Published: 2021-11-07
Description: Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.
CVSS Score: 7.5 (HIGH)
References: https://cradlepoint.com/product/endpoints/ibr900/; https://securitybytes.me/posts/cve-2021-37471/; https://cradlepoint.com/product/endpoints/ibr900/
CVE: CVE-2021-25978
Published: 2021-11-07
Description: Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59; https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59
CVE: CVE-2021-43411
Published: 2021-11-07
Description: An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the new privileges, but still refers to the old task and is accessible through the old process port. This can be exploited to get full root access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://lists.gnu.org/archive/html/bug-hurd/2021-05/msg00079.html; https://salsa.debian.org/hurd-team/hurd/-/blob/4d1b079411e2f40576e7b58f9b5b78f733a2beda/debian/patches/0034-proc-Use-UIDs-for-evaluating-permissions.patch; https://www.mail-archive.com/bug-hurd%40gnu.org/msg32112.html