deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43872
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix soft lockup under heavy CEQE load

CEQEs are handled in interrupt handler currently. This may cause the
CPU core staying in interrupt context too long and lead to soft lockup
under heavy load.

Handle CEQEs in BH workqueue and set an upper limit for the number of
CEQE handled by a single call of work handler.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/06580b33c183c9f98e2a2ca96a[PII_REDACTED]2c08; https://git.kernel.org/stable/c/2fdf34038369c0a27811e7b4680662a14ada1d6b
CVE: CVE-2024-43873
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

vhost/vsock: always initialize seqpacket_allow

There are two issues around seqpacket_allow:
1. seqpacket_allow is not initialized when socket is
   created. Thus if features are never set, it will be
   read uninitialized.
2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared,
   then seqpacket_allow will not be cleared appropriately
   (existing apps I know about don't usually do this but
    it's legal and there's no way to be sure no one relies
    on this).

To fix:
	- initialize seqpacket_allow after allocation
	- set it unconditionally in set_features
CVSS Score: 7.8 (HIGH)
CWE: CWE-909
References: https://git.kernel.org/stable/c/1e1fdcbdde3b7663e5d8faeb2245b9b151417d22; https://git.kernel.org/stable/c/3062cb100787a9ddf45de30004b962035cd497fb; https://git.kernel.org/stable/c/30bd[PII_REDACTED]ac58515e23557dc8cef70d8582
CVE: CVE-2024-43875
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: Clean up error handling in vpci_scan_bus()

Smatch complains about inconsistent NULL checking in vpci_scan_bus():

    drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpci_scan_bus() error: we previously assumed 'vpci_bus' could be null (see line 1021)

Instead of printing an error message and then crashing we should return
an error code and clean up.

Also the NULL check is reversed so it prints an error for success
instead of failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0e27e2e8697b8ce96cdef43f135426525d9d1f8f; https://git.kernel.org/stable/c/24414c842a24d0fd498f9db6d2a762a8dddf1832; https://git.kernel.org/stable/c/7d368de78b60088ec9031c60c88976c0063ea4c0
CVE: CVE-2024-43876
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()

Avoid large backtrace, it is sufficient to warn the user that there has
been a link problem. Either the link has failed and the system is in need
of maintenance, or the link continues to work and user has been informed.
The message from the warning can be looked up in the sources.

This makes an actual link issue less verbose.

First of all, this controller has a limitation in that the controller
driver has to assist the hardware with transition to L1 link state by
writing L1IATN to PMCTRL register, the L1 and L0 link state switching
is not fully automatic on this controller.

In case of an ASMedia ASM1062 PCIe SATA controller which does not support
ASPM, on entry to suspend or during platform pm_test, the SATA controller
enters D3hot state and the link enters L1 state. If the SATA controller
wakes up before rcar_pcie_wakeup() was called and returns to D0, the link
returns to L0 before the controller driver even started its transition to
L1 link state. At this point, the SATA controller did send an PM_ENTER_L1
DLLP to the PCIe controller and the PCIe controller received it, and the
PCIe controller did set PMSR PMEL1RX bit.

Once rcar_pcie_wakeup() is called, if the link is already back in L0 state
and PMEL1RX bit is set, the controller driver has no way to determine if
it should perform the link transition to L1 state, or treat the link as if
it is in L0 state. Currently the driver attempts to perform the transition
to L1 link state unconditionally, which in this specific case fails with a
PMSR L1FAEG poll timeout, however the link still works as it is already
back in L0 state.

Reduce this warning verbosity. In case the link is really broken, the
rcar_pcie_config_access() would fail, otherwise it will succeed and any
system with this controller and ASM1062 can suspend without generating
a backtrace.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2ae4769332dfdb97f4b6f5dc9ac8f46d02aaa3df; https://git.kernel.org/stable/c/3ff3bdde950f1840df4030726cef156758a244d7; https://git.kernel.org/stable/c/526a877c6273d4cd0d0aede84c1d620479764b1c
CVE: CVE-2024-43877
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

media: pci: ivtv: Add check for DMA map result

In case DMA fails, 'dma->SG_length' is 0. This value is later used to
access 'dma->SGarray[dma->SG_length - 1]', which will cause out of
bounds access.

Add check to return early on invalid value. Adjust warnings accordingly.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/24062aa7407091dee3e45a8e8037df437e848718; https://git.kernel.org/stable/c/38f72c7e7c6b55614f9407555fd5ce9d019b0fa4; https://git.kernel.org/stable/c/3d8fd92939e21ff0d45100ab208f8124af79402a
CVE: CVE-2024-43879
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()

Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in
cfg80211_calculate_bitrate_he(), leading to below warning:

kernel: invalid HE MCS: bw:6, ru:6
kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211]

Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/16ad67e73309db0c20cc2a651992bd01c05e6b27; https://git.kernel.org/stable/c/19eaf4f2f5a981f55a265242ada2bf92b0c742dd; https://git.kernel.org/stable/c/2e201b3d162c6c49417c438ffb30b58c9f85769f
CVE: CVE-2024-43881
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: change DMA direction while mapping reinjected packets

For fragmented packets, ath12k reassembles each fragment as a normal
packet and then reinjects it into HW ring. In this case, the DMA
direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,
an invalid payload may be reinjected into the HW and
subsequently delivered to the host.

Given that arbitrary memory can be allocated to the skb buffer,
knowledge about the data contained in the reinjected buffer is lacking.
Consequently, there’s a risk of private information being leaked.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1
CVSS Score: 7.1 (HIGH)
CWE: CWE-668
References: https://git.kernel.org/stable/c/33322e3ef07409278a18c6919c448e369d66a18e; https://git.kernel.org/stable/c/6925320fcd40d8042d32bf4ede8248e7a5315c3b; https://git.kernel.org/stable/c/e99d9b16ff153de[PII_REDACTED]d24adc3b0a3a997
CVE: CVE-2024-43882
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

exec: Fix ToCToU between perm check and set-uid/gid usage

When opening a file for exec via do_filp_open(), permission checking is
done against the file's metadata at that moment, and on success, a file
pointer is passed back. Much later in the execve() code path, the file
metadata (specifically mode, uid, and gid) is used to determine if/how
to set the uid and gid. However, those values may have changed since the
permissions check, meaning the execution may gain unintended privileges.

For example, if a file could change permissions from executable and not
set-id:

---------x 1 root root 16048 Aug  7 13:16 target

to set-id and non-executable:

---S------ 1 root root 16048 Aug  7 13:16 target

it is possible to gain root privileges when execution should have been
disallowed.

While this race condition is rare in real-world scenarios, it has been
observed (and proven exploitable) when package managers are updating
the setuid bits of installed programs. Such files start with being
world-executable but then are adjusted to be group-exec with a set-uid
bit. For example, "chmod o-x,u+s target" makes "target" executable only
by uid "root" and gid "cdrom", while also becoming setuid-root:

-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target

becomes:

-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target

But racing the chmod means users without group "cdrom" membership can
get the permission to execute "target" just before the chmod, and when
the chmod finishes, the exec reaches brpm_fill_uid(), and performs the
setuid to root, violating the expressed authorization of "only cdrom
group members can setuid to root".

Re-check that we still have execute permissions in case the metadata
has changed. It would be better to keep a copy from the perm-check time,
but until we can do that refactoring, the least-bad option is to do a
full inode_permission() call (under inode lock). It is understood that
this is safe against dead-locks, but hardly optimal.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://git.kernel.org/stable/c/15469d46ba34559bfe7e3de[PII_REDACTED]c624759; https://git.kernel.org/stable/c/368f6985d46657b8b466a421dddcacd4051f7ada; https://git.kernel.org/stable/c/90dfbba89ad4f0d9c9744ecbb1adac4aa2ff4f3e
CVE: CVE-2024-38305
Published: 2024-08-21
Description: Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executables on the operating system with elevated privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: https://www.dell.com/support/kbdoc/en-us/000227899/dsa-2024-312-security-update-for-dell-supportassist-for-home-pcs-installer-file-local-privilege-escalation-vulnerability
CVE: CVE-2024-42939
Published: 2024-08-21
Description: A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the configured remarks text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/tcyba/open_vul/blob/main/yzncms%20has%20a%20storage%20xss%20vulnerability.pdf
CVE: CVE-2024-5880
Published: 2024-08-21
Description: The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricting access to the REST API when password protection is enabled. This makes it possible for unauthenticated attackers to gain unauthorized access to the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://wordpress.org/plugins/hide-my-site/; https://www.wordfence.com/threat-intel/vulnerabilities/id/31d2ccd2-d38b-4bdf-a905-a2b54ca80a58?source=cve
CVE: CVE-2024-6508
Published: 2024-08-21
Description: An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.
CVSS Score: 8.0 (HIGH)
CWE: CWE-331
References: https://access.redhat.com/errata/RHSA-2024:10813; https://access.redhat.com/errata/RHSA-2024:7922; https://access.redhat.com/errata/RHSA-2024:8415
CVE: CVE-2024-6568
Published: 2024-08-21
Description: The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/flamix-bitrix24-and-contact-forms-7-integrations/trunk/includes/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3138051%40flamix-bitrix24-and-contact-forms-7-integrations&new=3138051%40flamix-bitrix24-and-contact-forms-7-integrations&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/da2050ea-70b3-476d-841f-021c3baddf35?source=cve
CVE: CVE-2024-6767
Published: 2024-08-21
Description: The WordSurvey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sounding_title’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wordsurvey/trunk/wordsurvey-add.php#L45; https://wordpress.org/plugins/wordsurvey/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/626dac34-6b25-42c9-8f7d-9899e4bcc039?source=cve
CVE: CVE-2024-6883
Published: 2024-08-21
Description: The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to and including 4.10.46.decaf. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify some of the plugin settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/event-espresso-decaf/tags/4.10.46.decaf/admin_pages/events/Events_Admin_Page.core.php#L2800; https://www.wordfence.com/threat-intel/vulnerabilities/id/689abb68-0c19-4f89-91db-fd15ab8bca8e?source=cve
CVE: CVE-2024-7013
Published: 2024-08-21
Description: Stack-based buffer overflow in Control FPWIN Pro version 7.7.2.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://industry.panasonic.com/jp/ja/products/fasys/plc/software/fpwinpro7; https://industry.panasonic.eu/products/automation-devices-solutions/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro
CVE: CVE-2024-7030
Published: 2024-08-21
Description: The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update product and category descriptions, category titles and images, and sort order.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/clover-online-orders/trunk/admin/js/moo-OnlineOrders-admin.js; https://plugins.trac.wordpress.org/browser/clover-online-orders/trunk/public/moo-OnlineOrders-public.php; https://plugins.trac.wordpress.org/changeset/3142846/
CVE: CVE-2024-7032
Published: 2024-08-21
Description: The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndClean' function in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to deactivate the plugin and drop all plugin tables from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/clover-online-orders/trunk/includes/moo-OnlineOrders-deactivator.php#L29; https://plugins.trac.wordpress.org/browser/clover-online-orders/trunk/moo_OnlineOrders.php#L183; https://plugins.trac.wordpress.org/changeset/3142846/
CVE: CVE-2024-7090
Published: 2024-08-21
Description: The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lh_add_media_from_url-file_url’ parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/lh-add-media-from-url/trunk/lh-add-media-from-url.php#L173; https://plugins.trac.wordpress.org/browser/lh-add-media-from-url/trunk/partials/upload.php#L6; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3138229%40lh-add-media-from-url&new=3138229%40lh-add-media-from-url&sfp_email=&sfph_mail=
CVE: CVE-2024-7134
Published: 2024-08-21
Description: The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘form_data’ parameter in all versions up to, and including, 3.3.78 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-poll/trunk/includes/classes/class-hooks.php#L408; https://wordpress.org/plugins/wp-poll/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/3e62eba7-1ac9-4420-8692-58a169aa4330?source=cve
CVE: CVE-2024-7390
Published: 2024-08-21
Description: The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrder function in all versions up to, and including, 3.1. This makes it possible for unauthenticated attackers to change the order of testimonials.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-testimonial-widget/trunk/functions.php#L358; https://www.wordfence.com/threat-intel/vulnerabilities/id/67eef869-a57f-40b5-b289-9353bf5b680a?source=cve
CVE: CVE-2024-7629
Published: 2024-08-21
Description: The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires responsive videos to be enabled for posts.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://plugins.trac.wordpress.org/browser/responsive-video/trunk/responsive-video.php#L534; https://www.wordfence.com/threat-intel/vulnerabilities/id/c530f5d2-eed3-433b-bf96-656593ad6ce2?source=cve
CVE: CVE-2024-7647
Published: 2024-08-21
Description: The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing or incorrect nonce validation on the otasync_widget_settings_fnc() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/ota-sync-booking-engine-widget/trunk/otasync-widget.php#L72; https://plugins.trac.wordpress.org/changeset/3201696/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3196168%40ota-sync-booking-engine-widget&new=3196168%40ota-sync-booking-engine-widget&sfp_email=&sfph_mail=
CVE: CVE-2024-7651
Published: 2024-08-21
Description: The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and including, 4.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/app-builder/trunk/includes/pure.php#L18; https://plugins.trac.wordpress.org/changeset/3138976/app-builder/tags/4.3.4/includes/pure.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b43371a6-bcb5-4418-b5a5[PII_REDACTED]0c?source=cve
CVE: CVE-2024-7854
Published: 2024-08-21
Description: The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/woo-inquiry/trunk/includes/functions.php?rev=2088873#L307; https://www.wordfence.com/threat-intel/vulnerabilities/id/312a6601-c914-4661-82ff-6f8bac849442?source=cve
CVE: CVE-2024-7998
Published: 2024-08-21
Description: In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan.
CVSS Score: 2.6 (LOW)
CWE: CWE-613
References: https://advisories.octopus.com/post/2024/sa2024-07/
CVE: CVE-2022-48867
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Prevent use after free on completion memory

On driver unload any pending descriptors are flushed at the
time the interrupt is freed:
idxd_dmaengine_drv_remove() ->
	drv_disable_wq() ->
		idxd_wq_free_irq() ->
			idxd_flush_pending_descs().

If there are any descriptors present that need to be flushed this
flow triggers a "not present" page fault as below:

 BUG: unable to handle page fault for address: ff391c97c70c9040
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page

The address that triggers the fault is the address of the
descriptor that was freed moments earlier via:
drv_disable_wq()->idxd_wq_free_resources()

Fix the use after free by freeing the descriptors after any possible
usage. This is done after idxd_wq_reset() to ensure that the memory
remains accessible during possible completion writes by the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1beeec45f9ac31eba52478379f70a5fa9c2ad005; https://git.kernel.org/stable/c/b9e8e3fcfec625fc1c2f68f684448aeeb882625b