deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-32936
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

media: ti: j721e-csi2rx: Fix races while restarting DMA

After the frame is submitted to DMA, it may happen that the submitted
list is not updated soon enough, and the DMA callback is triggered
before that.

This can lead to kernel crashes, so move everything in a single
lock/unlock section to prevent such races.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea; https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b; https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea
CVE: CVE-2024-33278
Published: 2024-06-24
Description: Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the connection_state_machine due to improper length validation for the cookie field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://gist.github.com/viktoredstrom/cd2580fb0e93e47133b2998553b0a52f; https://www.asus.com/content/asus-product-security-advisory/; https://gist.github.com/viktoredstrom/cd2580fb0e93e47133b2998553b0a52f
CVE: CVE-2024-33847
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: don't allow unaligned truncation on released compress inode

f2fs image may be corrupted after below testcase:
- mkfs.f2fs -O extra_attr,compression -f /dev/vdb
- mount /dev/vdb /mnt/f2fs
- touch /mnt/f2fs/file
- f2fs_io setflags compression /mnt/f2fs/file
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=4
- f2fs_io release_cblocks /mnt/f2fs/file
- truncate -s 8192 /mnt/f2fs/file
- umount /mnt/f2fs
- fsck.f2fs /dev/vdb

[ASSERT] (fsck_chk_inode_blk:1256)  --> ino: 0x5 has i_blocks: 0x00000002, but has 0x3 blocks
[FSCK] valid_block_count matching with CP             [Fail] [0x4, 0x5]
[FSCK] other corrupted bugs                           [Fail]

The reason is: partial truncation assume compressed inode has reserved
blocks, after partial truncation, valid block count may change w/o
.i_blocks and .total_valid_block_count update, result in corruption.

This patch only allow cluster size aligned truncation on released
compress inode for fixing.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/29ed2b5dd521ce7c5d8466cd70bf0cc9d07afeee; https://git.kernel.org/stable/c/3ccf5210dc941a7aa0180596ac021568be4d35ec; https://git.kernel.org/stable/c/5268241b41b1c5d0acca75e9b97d4fd719251c8c
CVE: CVE-2024-34027
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock

It needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
to avoid racing with checkpoint, otherwise, filesystem metadata including
blkaddr in dnode, inode fields and .total_valid_block_count may be
corrupted after SPO case.
CVSS Score: 7.0 (HIGH)
CWE: CWE-770
References: https://git.kernel.org/stable/c/0a4ed2d97cb6d044196cc3e726b6699222b41019; https://git.kernel.org/stable/c/329edb7c9e3b6ca27e6ca67ab1cdda1740fb3a2b; https://git.kernel.org/stable/c/5d47d[PII_REDACTED]8825ca2efc4fca[PII_REDACTED]f
CVE: CVE-2024-34030
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: of_property: Return error for int_map allocation failure

Return -ENOMEM from of_pci_prop_intr_map() if kcalloc() fails to prevent a
NULL pointer dereference in this case.

[bhelgaas: commit log]
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/598e4a37a2f8da9144ba1fab04320c32169b6d0d; https://git.kernel.org/stable/c/b5f31d1470c4fdfae368feeb389768ba8d24fb34; https://git.kernel.org/stable/c/e6f7d27df5d208b50cae817a91d128fb434bb12c
CVE: CVE-2024-35247
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

fpga: region: add owner module and take its refcount

The current implementation of the fpga region assumes that the low-level
module registers a driver for the parent device and uses its owner pointer
to take the module's refcount. This approach is problematic since it can
lead to a null pointer dereference while attempting to get the region
during programming if the parent device does not have a driver.

To address this problem, add a module owner pointer to the fpga_region
struct and use it to take the module's refcount. Modify the functions for
registering a region to take an additional owner module parameter and
rename them to avoid conflicts. Use the old function names for helper
macros that automatically set the module that registers the region as the
owner. This ensures compatibility with existing low-level control modules
and reduces the chances of registering a region without setting the owner.

Also, update the documentation to keep it consistent with the new interface
for registering an fpga region.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2279c09c36165ccded4d506d11a7714e13b56019; https://git.kernel.org/stable/c/26e6e25d742e29885cf44274fcf6b744366c4702; https://git.kernel.org/stable/c/4d7d12b643c00e7eea51b49a60a2ead182633ec8
CVE: CVE-2024-36479
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

fpga: bridge: add owner module and take its refcount

The current implementation of the fpga bridge assumes that the low-level
module registers a driver for the parent device and uses its owner pointer
to take the module's refcount. This approach is problematic since it can
lead to a null pointer dereference while attempting to get the bridge if
the parent device does not have a driver.

To address this problem, add a module owner pointer to the fpga_bridge
struct and use it to take the module's refcount. Modify the function for
registering a bridge to take an additional owner module parameter and
rename it to avoid conflicts. Use the old function name for a helper macro
that automatically sets the module that registers the bridge as the owner.
This ensures compatibility with existing low-level control modules and
reduces the chances of registering a bridge without setting the owner.

Also, update the documentation to keep it consistent with the new interface
for registering an fpga bridge.

Other changes: opportunistically move put_device() from __fpga_bridge_get()
to fpga_bridge_get() and of_fpga_bridge_get() to improve code clarity since
the bridge device is taken in these functions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/18dc8366abb6cadcb77668b1a16434654e355d49; https://git.kernel.org/stable/c/1da11f822042eb6ef4b6064dc048f157a7852529; https://git.kernel.org/stable/c/6896b6b2e2d9ec4e1b0acb4c1698a75a4b34d125
CVE: CVE-2024-37021
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

fpga: manager: add owner module and take its refcount

The current implementation of the fpga manager assumes that the low-level
module registers a driver for the parent device and uses its owner pointer
to take the module's refcount. This approach is problematic since it can
lead to a null pointer dereference while attempting to get the manager if
the parent device does not have a driver.

To address this problem, add a module owner pointer to the fpga_manager
struct and use it to take the module's refcount. Modify the functions for
registering the manager to take an additional owner module parameter and
rename them to avoid conflicts. Use the old function names for helper
macros that automatically set the module that registers the manager as the
owner. This ensures compatibility with existing low-level control modules
and reduces the chances of registering a manager without setting the owner.

Also, update the documentation to keep it consistent with the new interface
for registering an fpga manager.

Other changes: opportunistically move put_device() from __fpga_mgr_get() to
fpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the
manager device is taken in these functions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2da62a139a6221a345db4eb9f4f1c4b0937c89ad; https://git.kernel.org/stable/c/304f8032d601d4f9322ca841cd0b573bd1beb158; https://git.kernel.org/stable/c/4d4d2d4346857bf778fafaa97d6f76bb1663e3c9
CVE: CVE-2024-37026
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Only use reserved BCS instances for usm migrate exec queue

The GuC context scheduling queue is 2 entires deep, thus it is possible
for a migration job to be stuck behind a fault if migration exec queue
shares engines with user jobs. This can deadlock as the migrate exec
queue is required to service page faults. Avoid deadlock by only using
reserved BCS instances for usm migrate exec queue.

(cherry picked from commit 04f4a70a183a688a60fe3882d6e4236ea02cfc67)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/92deed4a9bfd9ef187764225bba530116c49e15c; https://git.kernel.org/stable/c/c8ea2c31f5ea437199b239d76ad5db27343edb0c; https://git.kernel.org/stable/c/92deed4a9bfd9ef187764225bba530116c49e15c
CVE: CVE-2024-37825
Published: 2024-06-24
Description: An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthenticated attackers on the same network to perform a directory traversal.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/J0rdanis99/74ae1ee2f9777cdd1c9756f958064d7c; https://www.envisionware.com/?lang=au; https://www.envisionware.com/pcres/?lang=au
CVE: CVE-2024-38384
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix list corruption from reorder of WRITE ->lqueued

__blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start
is being executed.

If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in
the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one
stat instance being added in blk_cgroup_bio_start(), then the local
list in __blkcg_rstat_flush() could be corrupted.

Fix the issue by adding one barrier.
CVSS Score: 8.4 (HIGH)
CWE: CWE-400
References: https://git.kernel.org/stable/c/714e59b5456e4d6e4295a9968c564abe193f461c; https://git.kernel.org/stable/c/785298ab6b802afa[PII_REDACTED]6b6bbea590809c; https://git.kernel.org/stable/c/d0aac2363549e12cc79b8e285f13d5a9f42fd08e
CVE: CVE-2024-38663
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix list corruption from resetting io stat

Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()"),
each iostat instance is added to blkcg percpu list, so blkcg_reset_stats()
can't reset the stat instance by memset(), otherwise the llist may be
corrupted.

Fix the issue by only resetting the counter part.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6da[PII_REDACTED]709cecf2b006f2fe3ca7857e791; https://git.kernel.org/stable/c/89bb36c72e1951843f9e04dc84412e31fcc849a9; https://git.kernel.org/stable/c/d4a60298ac34f027a09f8f893fdbd9e06279bb24
CVE: CVE-2024-38664
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm: zynqmp_dpsub: Always register bridge

We must always register the DRM bridge, since zynqmp_dp_hpd_work_func
calls drm_bridge_hpd_notify, which in turn expects hpd_mutex to be
initialized. We do this before zynqmp_dpsub_drm_init since that calls
drm_bridge_attach. This fixes the following lockdep warning:

[   19.217084] ------------[ cut here ]------------
[   19.227530] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
[   19.227768] WARNING: CPU: 0 PID: 140 at kernel/locking/mutex.c:582 __mutex_lock+0x4bc/0x550
[   19.241696] Modules linked in:
[   19.244937] CPU: 0 PID: 140 Comm: kworker/0:4 Not tainted 6.6.20+ #96
[   19.252046] Hardware name: xlnx,zynqmp (DT)
[   19.256421] Workqueue: events zynqmp_dp_hpd_work_func
[   19.261795] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   19.269104] pc : __mutex_lock+0x4bc/0x550
[   19.273364] lr : __mutex_lock+0x4bc/0x550
[   19.277592] sp : ffffffc085c5bbe0
[   19.281066] x29: ffffffc085c5bbe0 x28: [PII_REDACTED] x27: ffffff88009417f8
[   19.288624] x26: ffffff[PII_REDACTED] x25: ffffff[PII_REDACTED] x24: ffffffc082aa3000
[   19.296227] x23: ffffffc080d90e3c x22: [PII_REDACTED] x21: [PII_REDACTED]
[   19.303744] x20: [PII_REDACTED] x19: ffffff88002f5210 x18: [PII_REDACTED]
[   19.311295] x17: 6c707369642e3030 x16: [PII_REDACTED] x15: [PII_REDACTED]
[   19.318922] x14: [PII_REDACTED] x13: 284e4f5f4e524157 x12: [PII_REDACTED]
[   19.326442] x11: 0001ffc085c5b940 x10: 0001ff88003f388b x9 : 0001ff88003f3888
[   19.334003] x8 : 0001ff88003f3888 x7 : [PII_REDACTED] x6 : [PII_REDACTED]
[   19.341537] x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : [PII_REDACTED]
[   19.349054] x2 : [PII_REDACTED] x1 : [PII_REDACTED] x0 : ffffff88003f3880
[   19.356581] Call trace:
[   19.359160]  __mutex_lock+0x4bc/0x550
[   19.363032]  mutex_lock_nested+0x24/0x30
[   19.367187]  drm_bridge_hpd_notify+0x2c/0x6c
[   19.371698]  zynqmp_dp_hpd_work_func+0x44/0x54
[   19.376364]  process_one_work+0x3ac/0x988
[   19.380660]  worker_thread+0x398/0x694
[   19.384736]  kthread+0x1bc/0x1c0
[   19.388241]  ret_from_fork+0x10/0x20
[   19.392031] irq event stamp: 183
[   19.395450] hardirqs last  enabled at (183): [<ffffffc0800b9278>] finish_task_switch.isra.0+0xa8/0x2d4
[   19.405140] hardirqs last disabled at (182): [<ffffffc081ad3754>] __schedule+0x714/0xd04
[   19.413612] softirqs last  enabled at (114): [<ffffffc080133de8>] srcu_invoke_callbacks+0x158/0x23c
[   19.423128] softirqs last disabled at (110): [<ffffffc080133de8>] srcu_invoke_callbacks+0x158/0x23c
[   19.432614] ---[ end trace [PII_REDACTED] ]---

(cherry picked from commit 61ba791c4a7a09a370c45b70a81b8c7d4cf6b2ae)
CVSS Score: 7.8 (HIGH)
CWE: CWE-667
References: https://git.kernel.org/stable/c/[PII_REDACTED]56b5e5ba6d86f505fbc936eff396ba; https://git.kernel.org/stable/c/6ead3eccf67bc8318b1ce95ed879b2cc05b4fce9; https://git.kernel.org/stable/c/be3f3042391d061cfca2bd22630e0d101acea5fc
CVE: CVE-2024-38667
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: prevent pt_regs corruption for secondary idle threads

Top of the kernel thread stack should be reserved for pt_regs. However
this is not the case for the idle threads of the secondary boot harts.
Their stacks overlap with their pt_regs, so both may get corrupted.

Similar issue has been fixed for the primary hart, see c7cdd96eca28
("riscv: prevent stack corruption by reserving task_pt_regs(p) early").
However that fix was not propagated to the secondary harts. The problem
has been noticed in some CPU hotplug tests with V enabled. The function
smp_callin stored several registers on stack, corrupting top of pt_regs
structure including status field. As a result, kernel attempted to save
or restore inexistent V context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/0c1f28c32a194303da630fca89481334b9547b80; https://git.kernel.org/stable/c/3090c06d50eaa91317f84bf3eac4c265e6cb8d44; https://git.kernel.org/stable/c/a638b0461b58aa3205cd9d5f14d6f703d795b4af
CVE: CVE-2024-39291
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating
about potential truncation of output when using the snprintf function.
The issue was due to the size of the buffer 'ucode_prefix' being too
small to accommodate the maximum possible length of the string being
written into it.

The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
where %s is replaced by the value of 'chip_name'. The length of this
string without the %s is 16 characters. The warning message indicated
that 'chip_name' could be up to 29 characters long, resulting in a total
of 45 characters, which exceeds the buffer size of 30 characters.

To resolve this issue, the size of the 'ucode_prefix' buffer has been
reduced from 30 to 15. This ensures that the maximum possible length of
the string being written into the buffer will not exceed its size, thus
preventing potential buffer overflow and truncation issues.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
  379 |         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
      |                                                    ^~
......
  439 |         r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
      |                                                 ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
  379 |         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
  413 |         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
      |                                                    ^~
......
  443 |         r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
      |                                                        ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
  413 |         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460; https://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec; https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b
CVE: CVE-2024-39292
Published: 2024-06-24
Description: In the Linux kernel, the following vulnerability has been resolved:

um: Add winch to winch_handlers before registering winch IRQ

Registering a winch IRQ is racy, an interrupt may occur before the winch is
added to the winch_handlers list.

If that happens, register_winch_irq() adds to that list a winch that is
scheduled to be (or has already been) freed, causing a panic later in
winch_cleanup().

Avoid the race by adding the winch to the winch_handlers list before
registering the IRQ, and rolling back if um_request_irq() fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://git.kernel.org/stable/c/0c02d425a2fbe52643a5859a779db0329e7dddd4; https://git.kernel.org/stable/c/31960d991e43c8d6dc07245f19fc13398e90ead2; https://git.kernel.org/stable/c/351d1a64544944b44732f6a64ed65573b00b9e14
CVE: CVE-2024-4748
Published: 2024-06-24
Description: The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. 
The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which would send such a malicious request to the locally launched server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://cert.pl/en/posts/2024/06/CVE-2024-4748; https://cert.pl/posts/2024/06/CVE-2024-4748; https://github.com/jan-vandenberg/cruddiy/issues/67
CVE: CVE-2024-33687
Published: 2024-06-24
Description: Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345, CWE-345
References: https://jvn.jp/en/vu/JVNVU92504444/; https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-004_en.pdf; https://jvn.jp/en/vu/JVNVU92504444/
CVE: CVE-2024-6285
Published: 2024-06-24
Description: Integer Underflow (Wrap or Wraparound) vulnerability in Renesas arm-trusted-firmware.
An integer underflow in image range check calculations could lead to bypassing address restrictions and loading of images to unallowed addresses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191, CWE-191
References: https://asrg.io/security-advisories/cve-2024-6285/; https://github.com/renesas-rcar/arm-trusted-firmware/commit/b596f580637bae919b0ac3a5471422a1f756db3b; https://asrg.io/security-advisories/cve-2024-6285/
CVE: CVE-2024-6287
Published: 2024-06-24
Description: Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code.


When checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682, CWE-682
References: https://asrg.io/security-advisories/cve-2024-6287/; https://github.com/renesas-rcar/arm-trusted-firmware/commit/954d488a9798f8fda675c6b57c571b469b298f04; https://asrg.io/security-advisories/cve-2024-6287/
CVE: CVE-2024-33879
Published: 2024-06-24
Description: An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq; https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf; https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq
CVE: CVE-2024-33880
Published: 2024-06-24
Description: An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq&gt%3B; https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf; https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq&gt%3B
CVE: CVE-2024-33881
Published: 2024-06-24
Description: An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-200
References: https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq; https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf; https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq