deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-26491
Published: 2024-02-22
Description: A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/[PII_REDACTED]/cms/blob/main/1.md; https://github.com/[PII_REDACTED]/cms/blob/main/1.md
CVE: CVE-2023-29179
Published: 2024-02-22
Description: A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 allows attacker to denial of service via  specially crafted HTTP requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://fortiguard.com/psirt/FG-IR-23-125; https://fortiguard.com/psirt/FG-IR-23-125
CVE: CVE-2023-29180
Published: 2024-02-22
Description: A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to denial of service via specially crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://fortiguard.com/psirt/FG-IR-23-111; https://fortiguard.com/psirt/FG-IR-23-111
CVE: CVE-2023-29181
Published: 2024-02-22
Description: A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: https://fortiguard.com/psirt/FG-IR-23-119; https://fortiguard.com/psirt/FG-IR-23-119
CVE: CVE-2024-22393
Published: 2024-02-22
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.

Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content.
Users are recommended to upgrade to version [1.2.5], which fixes the issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: http://www.openwall.com/lists/oss-security/2024/02/22/1; https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv; http://www.openwall.com/lists/oss-security/2024/02/22/1
CVE: CVE-2024-23349
Published: 2024-02-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.

XSS attack when user enters summary. A logged-in user, when modifying their own submitted question, can input malicious code in the summary to create such an attack.

Users are recommended to upgrade to version [1.2.5], which fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/02/22/2; https://lists.apache.org/thread/y5902t09vfgy7892z3vzr1zq900sgyqg; http://www.openwall.com/lists/oss-security/2024/02/22/2
CVE: CVE-2024-26578
Published: 2024-02-22
Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.

Repeated submission during registration resulted in the registration of the same user. When users register, if they rapidly submit multiple registrations using scripts, it can result in the creation of multiple user accounts simultaneously with the same name.
Users are recommended to upgrade to version [1.2.5], which fixes the issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: http://www.openwall.com/lists/oss-security/2024/02/22/3; https://lists.apache.org/thread/ko0ksnznt2484lxt0zts2ygr82ldkhcb; http://www.openwall.com/lists/oss-security/2024/02/22/3
CVE: CVE-2024-0220
Published: 2024-02-22
Description: B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.
CVSS Score: 8.3 (HIGH)
CWE: CWE-94, CWE-319, CWE-1240
References: https://www.br-automation.com/fileadmin/SA23P019_Automation_Studio_Upgrade_Service_uses_insufficient_encryption.pdf-1b3b181c.pdf; https://www.br-automation.com/fileadmin/SA23P019_Automation_Studio_Upgrade_Service_uses_insufficient_encryption.pdf-1b3b181c.pdf
CVE: CVE-2024-1104
Published: 2024-02-22
Description: An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://www.areal-topkapi.com/en/services/security-bulletins; https://www.areal-topkapi.com/en/services/security-bulletins
CVE: CVE-2024-25021
Published: 2024-02-22
Description: IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands.  IBM X-Force ID:  281320.
CVSS Score: 8.4 (HIGH)
CWE: CWE-114
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/281320; https://www.ibm.com/support/pages/node/7122628; https://exchange.xforce.ibmcloud.com/vulnerabilities/281320
CVE: CVE-2024-26287
Published: 2024-02-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-3966
Published: 2024-02-22
Description: A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://access.redhat.com/security/cve/CVE-2023-3966; https://bugzilla.redhat.com/show_bug.cgi?id=2178363; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/
CVE: CVE-2024-23094
Published: 2024-02-22
Description: Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_media_gallery/action/edit_addon_post.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/TinkAnet/cve/blob/main/csrf3.md; https://github.com/TinkAnet/cve/blob/main/csrf3.md
CVE: CVE-2024-25873
Published: 2024-02-22
Description: Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://github.com/dd3x3r/enhavo/blob/main/html-injection-page-content-blockquote-author-v0.13.1.md; https://www.enhavo.com/; https://github.com/dd3x3r/enhavo/blob/main/html-injection-page-content-blockquote-author-v0.13.1.md
CVE: CVE-2024-25874
Published: 2024-02-22
Description: A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Create Tag text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/dd3x3r/enhavo/blob/main/xss-create-tag-v0.13.1.md; https://www.enhavo.com/; https://github.com/dd3x3r/enhavo/blob/main/xss-create-tag-v0.13.1.md
CVE: CVE-2024-25875
Published: 2024-02-22
Description: A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dd3x3r/enhavo/blob/main/xss-page-content-header-undertitel-v0.13.1.md; https://www.enhavo.com/; https://github.com/dd3x3r/enhavo/blob/main/xss-page-content-header-undertitel-v0.13.1.md
CVE: CVE-2024-25876
Published: 2024-02-22
Description: A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dd3x3r/enhavo/blob/main/xss-page-content-header-titel-v0.13.1.md; https://www.enhavo.com/; https://github.com/dd3x3r/enhavo/blob/main/xss-page-content-header-titel-v0.13.1.md
CVE: CVE-2024-26349
Published: 2024-02-22
Description: flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_translation.php
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Icycu123/cms/blob/main/1.md; https://github.com/Icycu123/cms/blob/main/1.md; https://github.com/Icycu123/Flusity-CMS-V2.33/blob/main/CVE-2024-26349.md
CVE: CVE-2024-26350
Published: 2024-02-22
Description: flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_contact_form_settings.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/Icycu123/cms/blob/main/2.md; https://github.com/Icycu123/cms/blob/main/2.md
CVE: CVE-2024-26351
Published: 2024-02-22
Description: flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_place.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://github.com/Icycu123/cms/blob/main/4.md; https://github.com/Icycu123/cms/blob/main/4.md
CVE: CVE-2024-26352
Published: 2024-02-22
Description: flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_places.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Icycu123/cms/blob/main/3.md; https://github.com/Icycu123/cms/blob/main/3.md; https://github.com/Icycu123/Flusity-CMS-V2.33/blob/main/CVE-2024-26352.md
CVE: CVE-2024-26445
Published: 2024-02-22
Description: flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_place.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://github.com/xiaolanjing0/cms/blob/main/1.md; https://github.com/xiaolanjing0/cms/blob/main/1.md
CVE: CVE-2023-44379
Published: 2024-02-22
Description: baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://basercms.net/security/JVN_73283159; https://github.com/baserproject/basercms/commit/18549396e5a9b8294306a54a876af164b0b57da4; https://github.com/baserproject/basercms/security/advisories/GHSA-66c2-p8rh-qx87
CVE: CVE-2023-51450
Published: 2024-02-22
Description: baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://basercms.net/security/JVN_09767360; https://github.com/baserproject/basercms/commit/18f426d63e752b4d22c40e9ea8d1f6e692ef601c; https://github.com/baserproject/basercms/security/advisories/GHSA-77fc-4cv5-hmfr
CVE: CVE-2024-1563
Published: 2024-02-22
Description: An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race condition. This vulnerability affects Focus for iOS < 122.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367, CWE-367
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1863831; https://www.mozilla.org/security/advisories/mfsa2024-09/; https://bugzilla.mozilla.org/show_bug.cgi?id=1863831
CVE: CVE-2024-25850
Published: 2024-02-22
Description: Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/no1rr/Vulnerability/blob/master/netis/igd_wps_set_wps_ap_ssid5g.md; https://www.netis-systems.com/; https://github.com/no1rr/Vulnerability/blob/master/netis/igd_wps_set_wps_ap_ssid5g.md
CVE: CVE-2024-25851
Published: 2024-02-22
Description: Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgitest.cgi.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/no1rr/Vulnerability/blob/master/netis/other_para_config_sequence.md; https://www.netis-systems.com/; https://github.com/no1rr/Vulnerability/blob/master/netis/other_para_config_sequence.md
CVE: CVE-2024-26281
Published: 2024-02-22
Description: Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. This vulnerability affects Firefox for iOS < 123.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1868005; https://www.mozilla.org/security/advisories/mfsa2024-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1868005
CVE: CVE-2024-26282
Published: 2024-02-22
Description: Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iOS < 123.
CVSS Score: 7.1 (HIGH)
CWE: CWE-80
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1863788; https://www.mozilla.org/security/advisories/mfsa2024-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1863788
CVE: CVE-2024-26283
Published: 2024-02-22
Description: An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.
CVSS Score: 7.8 (HIGH)
CWE: CWE-83
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1850158; https://www.mozilla.org/security/advisories/mfsa2024-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1850158
CVE: CVE-2024-26284
Published: 2024-02-22
Description: Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS < 123.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1860075; https://www.mozilla.org/security/advisories/mfsa2024-10/; https://bugzilla.mozilla.org/show_bug.cgi?id=1860075
CVE: CVE-2023-51388
Published: 2024-02-22
Description: Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2; https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj; https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2
CVE: CVE-2023-51389
Published: 2024-02-22
Description: Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17; https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96; https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17
CVE: CVE-2023-51653
Published: 2024-02-22
Description: Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://github.com/dromara/hertzbeat/commit/f794b0d82be49c596c04a[PII_REDACTED]59eb315ef; https://github.com/dromara/hertzbeat/security/advisories/GHSA-gcmp-vf6v-59gg; https://github.com/dromara/hertzbeat/commit/f794b0d82be49c596c04a[PII_REDACTED]59eb315ef
CVE: CVE-2024-25828
Published: 2024-02-22
Description: cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-27
References: https://github.com/sec-Kode/cve; https://github.com/sec-Kode/cve
CVE: CVE-2023-52160
Published: 2024-02-22
Description: The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://lists.debian.org/debian-lts-announce/2024/02/msg00013.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N46C4DTVUWK336OYDA4LGALSC5VVPTCC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU6IR4KV3ZXJZLK2BY7HAHGZNCP7FPNI/
CVE: CVE-2023-52161
Published: 2024-02-22
Description: The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://git.kernel.org/pub/scm/network/wireless/iwd.git/commit/?id=6415420f1c92012f64063c131480ffcef58e60ca; https://iwd.wiki.kernel.org/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KSGT4IZ23CJBOQA3AFYEMBJ5OHFZBMK/
CVE: CVE-2023-52443
Published: 2024-02-22
Description: In the Linux kernel, the following vulnerability has been resolved:

apparmor: avoid crash when parsed profile name is empty

When processing a packed profile in unpack_profile() described like

 "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}"

a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then
passed to aa_splitn_fqname().

aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace.
Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later
aa_alloc_profile() crashes as the new profile name is NULL now.

general protection fault, probably for non-canonical address 0xdffffc[PII_REDACTED]: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x[PII_REDACTED]000000-0x[PII_REDACTED]000007]
CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
RIP: 0010:strlen+0x1e/0xa0
Call Trace:
 <TASK>
 ? strlen+0x1e/0xa0
 aa_policy_init+0x1bb/0x230
 aa_alloc_profile+0xb1/0x480
 unpack_profile+0x3bc/0x4960
 aa_unpack+0x309/0x15e0
 aa_replace_profiles+0x213/0x33c0
 policy_update+0x261/0x370
 profile_replace+0x20e/0x2a0
 vfs_write+0x2af/0xe00
 ksys_write+0x126/0x250
 do_syscall_64+0x46/0xf0
 entry_SYSCALL_64_after_hwframe+0x6e/0x76
 </TASK>
---[ end trace [PII_REDACTED] ]---
RIP: 0010:strlen+0x1e/0xa0

It seems such behaviour of aa_splitn_fqname() is expected and checked in
other places where it is called (e.g. aa_remove_profiles). Well, there
is an explicit comment "a ns name without a following profile is allowed"
inside.

AFAICS, nothing can prevent unpacked "name" to be in form like
":samba-dcerpcd" - it is passed from userspace.

Deny the whole profile set replacement in such case and inform user with
EPROTO and an explaining message.

Found by Linux Verification Center (linuxtesting.org).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0a12db736edbb4933e4274932aeea594b5876fa4; https://git.kernel.org/stable/c/1d8e62b5569cc1466ceb8a7e4872cf10160a9dcf; https://git.kernel.org/stable/c/55a8210c9e7d21ff[PII_REDACTED]765796d4bfb200
CVE: CVE-2023-52444
Published: 2024-02-22
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid dirent corruption

As Al reported in link[1]:

f2fs_rename()
...
	if (old_dir != new_dir && !whiteout)
		f2fs_set_link(old_inode, old_dir_entry,
					old_dir_page, new_dir);
	else
		f2fs_put_page(old_dir_page, 0);

You want correct inumber in the ".." link.  And cross-directory
rename does move the source to new parent, even if you'd been asked
to leave a whiteout in the old place.

[1] https://lore.kernel.org/all/[PII_REDACTED]5040.GN800259@ZenIV/

With below testcase, it may cause dirent corruption, due to it missed
to call f2fs_set_link() to update ".." link to new directory.
- mkdir -p dir/foo
- renameat2 -w dir/foo bar

[ASSERT] (__chk_dots_dentries:1421)  --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
[FSCK] other corrupted bugs                           [Fail]
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://git.kernel.org/stable/c/02160112e6d45c2610b049df6eb693d7a2e57b46; https://git.kernel.org/stable/c/2fb4867f4405aea8c0519d7d188207f232a57862; https://git.kernel.org/stable/c/53edb549565f55ccd0bdf43be3d66ce4c2d48b28
CVE: CVE-2023-52445
Published: 2024-02-22
Description: In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix use after free on context disconnection

Upon module load, a kthread is created targeting the
pvr2_context_thread_func function, which may call pvr2_context_destroy
and thus call kfree() on the context object. However, that might happen
before the usb hub_event handler is able to notify the driver. This
patch adds a sanity check before the invalid read reported by syzbot,
within the context disconnection call stack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795; https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e; https://git.kernel.org/stable/c/3233d8bf[PII_REDACTED]682192cb227af7fa3defeb