deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4217
Published: 2024-07-13
Description: The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/55cb43bf-7c8f-4df7-b4de-bf2bb1c2766d/; https://wpscan.com/vulnerability/55cb43bf-7c8f-4df7-b4de-bf2bb1c2766d/
CVE: CVE-2024-4269
Published: 2024-07-13
Description: The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8aae7aa1-6170-45d8-903f[PII_REDACTED]da/; https://wpscan.com/vulnerability/8aae7aa1-6170-45d8-903f[PII_REDACTED]da/
CVE: CVE-2024-4272
Published: 2024-07-13
Description: The Support SVG  WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ed1b1540-a0e2-434e-8769-9532c3ed5e31/; https://wpscan.com/vulnerability/ed1b1540-a0e2-434e-8769-9532c3ed5e31/
CVE: CVE-2024-4602
Published: 2024-07-13
Description: The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bc15bac7-8241-472a-a7c[PII_REDACTED]1d/; https://wpscan.com/vulnerability/bc15bac7-8241-472a-a7c[PII_REDACTED]1d/
CVE: CVE-2024-4752
Published: 2024-07-13
Description: The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/70d1f5d5-1a96-494b-9203-96a7780026da/; https://wpscan.com/vulnerability/70d1f5d5-1a96-494b-9203-96a7780026da/
CVE: CVE-2024-4977
Published: 2024-07-13
Description: The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/89791a80-5cff-4a1a-8163-94b5be4081a5/; https://wpscan.com/vulnerability/89791a80-5cff-4a1a-8163-94b5be4081a5/
CVE: CVE-2024-5002
Published: 2024-07-13
Description: The User Submitted Posts  WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/da09b99a-fa40-428f-80b4-0af764fd2f4f/; https://wpscan.com/vulnerability/da09b99a-fa40-428f-80b4-0af764fd2f4f/
CVE: CVE-2024-5028
Published: 2024-07-13
Description: The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/0bae8494-7b01-4203-a4f7-ccc60efbdda7/; https://wpscan.com/vulnerability/0bae8494-7b01-4203-a4f7-ccc60efbdda7/
CVE: CVE-2024-5032
Published: 2024-07-13
Description: The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4bb92693-23b3-4250-baee-af38b7e615e0/; https://wpscan.com/vulnerability/4bb92693-23b3-4250-baee-af38b7e615e0/
CVE: CVE-2024-5033
Published: 2024-07-13
Description: The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/dd42765a-1300-453f-9835-6e646c87e496/; https://wpscan.com/vulnerability/dd42765a-1300-453f-9835-6e646c87e496/
CVE: CVE-2024-5034
Published: 2024-07-13
Description: The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/31f3a3b5-07bf-4cb3-b[PII_REDACTED]733e0/; https://wpscan.com/vulnerability/31f3a3b5-07bf-4cb3-b[PII_REDACTED]733e0/
CVE: CVE-2024-5074
Published: 2024-07-13
Description: The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/174a2ba8-0215-480f-93ec-83ebc4a3200e/; https://wpscan.com/vulnerability/174a2ba8-0215-480f-93ec-83ebc4a3200e/
CVE: CVE-2024-5075
Published: 2024-07-13
Description: The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b47d93d6-5511-451a-853f-c8b0fba20969/; https://wpscan.com/vulnerability/b47d93d6-5511-451a-853f-c8b0fba20969/
CVE: CVE-2024-5076
Published: 2024-07-13
Description: The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/01cbc841-a30f-4df5-ab7f-0c2c7469657b/; https://wpscan.com/vulnerability/01cbc841-a30f-4df5-ab7f-0c2c7469657b/
CVE: CVE-2024-5077
Published: 2024-07-13
Description: The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/00fcbcf3-41ee-45e7-a0a9-0d46cb7ef859/; https://wpscan.com/vulnerability/00fcbcf3-41ee-45e7-a0a9-0d46cb7ef859/
CVE: CVE-2024-5079
Published: 2024-07-13
Description: The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perform Stored Cross-Site Scripting attacks
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bdb5509e-80ab-4e47-83a4-9347796eec40/; https://wpscan.com/vulnerability/bdb5509e-80ab-4e47-83a4-9347796eec40/
CVE: CVE-2024-5080
Published: 2024-07-13
Description: The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://wpscan.com/vulnerability/15f78aad-001c-4219-aa7e-46537e1357a2/; https://wpscan.com/vulnerability/15f78aad-001c-4219-aa7e-46537e1357a2/
CVE: CVE-2024-5151
Published: 2024-07-13
Description: The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1ede4c66-9932-4ba6-bba1-0ba13f5a2f8f/; https://wpscan.com/vulnerability/1ede4c66-9932-4ba6-bba1-0ba13f5a2f8f/
CVE: CVE-2024-5167
Published: 2024-07-13
Description: The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or whitelist, which could allow attackers to make a logged in admin add or delete settings from the blacklist or whitelist menu via a CSRF attack
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/67bb5ab8-4493-4f5b-a[PII_REDACTED]5b61a/; https://wpscan.com/vulnerability/67bb5ab8-4493-4f5b-a[PII_REDACTED]5b61a/
CVE: CVE-2024-5280
Published: 2024-07-13
Description: The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/bbc214ba-4e97-4b3a-a21b-2931a9e36973/; https://wpscan.com/vulnerability/bbc214ba-4e97-4b3a-a21b-2931a9e36973/
CVE: CVE-2024-5281
Published: 2024-07-13
Description: The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3c0bdb0f-a06a-47a8-9198-a2bf2678b8f1/; https://wpscan.com/vulnerability/3c0bdb0f-a06a-47a8-9198-a2bf2678b8f1/
CVE: CVE-2024-5282
Published: 2024-07-13
Description: The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bf3fb97e-12fa-4b37-b28b-1771ddb5ceb1/; https://wpscan.com/vulnerability/bf3fb97e-12fa-4b37-b28b-1771ddb5ceb1/
CVE: CVE-2024-5283
Published: 2024-07-13
Description: The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3e1adcd3-7c46-45e8-9e2b-2ede0d79c943/; https://wpscan.com/vulnerability/3e1adcd3-7c46-45e8-9e2b-2ede0d79c943/
CVE: CVE-2024-5284
Published: 2024-07-13
Description: The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/a601a267-e781-439f-9c76-b4c841e819e5/; https://wpscan.com/vulnerability/a601a267-e781-439f-9c76-b4c841e819e5/
CVE: CVE-2024-5286
Published: 2024-07-13
Description: The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a0b3069c-59d3-41ea-9b48-f5a4cf9ca45f/; https://wpscan.com/vulnerability/a0b3069c-59d3-41ea-9b48-f5a4cf9ca45f/
CVE: CVE-2024-5287
Published: 2024-07-13
Description: The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/b4fd535c-a273-419d-9e2e-be1cbd822793/; https://wpscan.com/vulnerability/b4fd535c-a273-419d-9e2e-be1cbd822793/
CVE: CVE-2024-5442
Published: 2024-07-13
Description: The Photo Gallery, Sliders, Proofing and   WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4f1fa417-f760-4132-95c2-a38d0b631263/; https://wpscan.com/vulnerability/4f1fa417-f760-4132-95c2-a38d0b631263/
CVE: CVE-2024-5450
Published: 2024-07-13
Description: The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://wpscan.com/vulnerability/d91217bc-9f8f-4971-885e-89edc45b2a4d/; https://wpscan.com/vulnerability/d91217bc-9f8f-4971-885e-89edc45b2a4d/
CVE: CVE-2024-5472
Published: 2024-07-13
Description: The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dcddc2de-c32c-4f8c-8490-f3d980b05822/; https://wpscan.com/vulnerability/dcddc2de-c32c-4f8c-8490-f3d980b05822/
CVE: CVE-2024-5575
Published: 2024-07-13
Description: The Ditty  WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/65d1abb7-92e9-4cc4-a1d0-84985b484af3/; https://wpscan.com/vulnerability/65d1abb7-92e9-4cc4-a1d0-84985b484af3/
CVE: CVE-2024-5627
Published: 2024-07-13
Description: The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5b18dc3d-0d5f-44e9-b22f-48ea0a9c9193/; https://wpscan.com/vulnerability/5b18dc3d-0d5f-44e9-b22f-48ea0a9c9193/
CVE: CVE-2024-5644
Published: 2024-07-13
Description: The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/afe14c7a-95b2-4d3f-901a-e53ecef70d49/; https://wpscan.com/vulnerability/afe14c7a-95b2-4d3f-901a-e53ecef70d49/
CVE: CVE-2024-5713
Published: 2024-07-13
Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/eb3f24a7-3171-42c3-9016-e29da4f384fa/; https://wpscan.com/vulnerability/eb3f24a7-3171-42c3-9016-e29da4f384fa/
CVE: CVE-2024-5715
Published: 2024-07-13
Description: The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d86bc001-51ae-4dcc-869b-80c91251cc2e/; https://wpscan.com/vulnerability/d86bc001-51ae-4dcc-869b-80c91251cc2e/
CVE: CVE-2024-5744
Published: 2024-07-13
Description: The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ba50e25c-7250-4025-a72f-74f8eb756246/; https://wpscan.com/vulnerability/ba50e25c-7250-4025-a72f-74f8eb756246/
CVE: CVE-2024-6070
Published: 2024-07-13
Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/97bab6cf-011c-4df4-976c-1f3252082f8f/; https://wpscan.com/vulnerability/97bab6cf-011c-4df4-976c-1f3252082f8f/
CVE: CVE-2024-6574
Published: 2024-07-13
Description: The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin not preventing direct access to several test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. This plugin is no longer being maintained and has been closed for downloads.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/laposta/trunk/includes/laposta-php-1.2/examples/member/all.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7632fe73-4011-4e6e-8ce7-38a9359ac259?source=cve; https://plugins.trac.wordpress.org/browser/laposta/trunk/includes/laposta-php-1.2/examples/member/all.php
CVE: CVE-2024-6465
Published: 2024-07-13
Description: The WP Links Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wplf_ajax_update_screenshots' function in all versions up to, and including, 4.9.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to regenerate the link's thumbnail image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-links-page/trunk/wp-links-page-free.php#L172; https://plugins.trac.wordpress.org/changeset/3116973/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2b59d281-d5c8-455a-8aa8-b03847bdd45f?source=cve
CVE: CVE-2024-6728
Published: 2024-07-14
Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file typeedit.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271401 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jeery0/cve/issues/1; https://vuldb.com/?ctiid.271401; https://vuldb.com/?id.271401
CVE: CVE-2024-6729
Published: 2024-07-14
Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /control/add_act.php. The manipulation of the argument aname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://reports.kunull.net/CVEs/2024/CVE-2024-6729; https://vuldb.com/?ctiid.271402; https://vuldb.com/?id.271402
CVE: CVE-2024-6730
Published: 2024-07-14
Description: A vulnerability was found in Nanjing Xingyuantu Technology SparkShop up to 1.1.6. It has been rated as critical. This issue affects some unknown processing of the file /api/Common/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271403.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/J1rrY-learn/learn/blob/main/sparkshop_upload.md; https://vuldb.com/?ctiid.271403; https://vuldb.com/?id.271403
CVE: CVE-2023-52885
Published: 2024-07-14
Description: In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

After the listener svc_sock is freed, and before invoking svc_tcp_accept()
for the established child sock, there is a window that the newsock
retaining a freed listener svc_sock in sk_user_data which cloning from
parent. In the race window, if data is received on the newsock, we will
observe use-after-free report in svc_tcp_listen_data_ready().

Reproduce by two tasks:

1. while :; do rpc.nfsd 0 ; rpc.nfsd; done
2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done

KASAN report:

  ==================================================================
  BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
  Read of size 8 at addr ffff888139d96228 by task nc/102553
  CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18
  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
  Call Trace:
   <IRQ>
   dump_stack_lvl+0x33/0x50
   print_address_description.constprop.0+0x27/0x310
   print_report+0x3e/0x70
   kasan_report+0xae/0xe0
   svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
   tcp_data_queue+0x9f4/0x20e0
   tcp_rcv_established+0x666/0x1f60
   tcp_v4_do_rcv+0x51c/0x850
   tcp_v4_rcv+0x23fc/0x2e80
   ip_protocol_deliver_rcu+0x62/0x300
   ip_local_deliver_finish+0x267/0x350
   ip_local_deliver+0x18b/0x2d0
   ip_rcv+0x2fb/0x370
   __netif_receive_skb_one_core+0x166/0x1b0
   process_backlog+0x24c/0x5e0
   __napi_poll+0xa2/0x500
   net_rx_action+0x854/0xc90
   __do_softirq+0x1bb/0x5de
   do_softirq+0xcb/0x100
   </IRQ>
   <TASK>
   ...
   </TASK>

  Allocated by task 102371:
   kasan_save_stack+0x1e/0x40
   kasan_set_track+0x21/0x30
   __kasan_kmalloc+0x7b/0x90
   svc_setup_socket+0x52/0x4f0 [sunrpc]
   svc_addsock+0x20d/0x400 [sunrpc]
   __write_ports_addfd+0x209/0x390 [nfsd]
   write_ports+0x239/0x2c0 [nfsd]
   nfsctl_transaction_write+0xac/0x110 [nfsd]
   vfs_write+0x1c3/0xae0
   ksys_write+0xed/0x1c0
   do_syscall_64+0x38/0x90
   entry_SYSCALL_64_after_hwframe+0x72/0xdc

  Freed by task 102551:
   kasan_save_stack+0x1e/0x40
   kasan_set_track+0x21/0x30
   kasan_save_free_info+0x2a/0x50
   __kasan_slab_free+0x106/0x190
   __kmem_cache_free+0x133/0x270
   svc_xprt_free+0x1e2/0x350 [sunrpc]
   svc_xprt_destroy_all+0x25a/0x440 [sunrpc]
   nfsd_put+0x125/0x240 [nfsd]
   nfsd_svc+0x2cb/0x3c0 [nfsd]
   write_threads+0x1ac/0x2a0 [nfsd]
   nfsctl_transaction_write+0xac/0x110 [nfsd]
   vfs_write+0x1c3/0xae0
   ksys_write+0xed/0x1c0
   do_syscall_64+0x38/0x90
   entry_SYSCALL_64_after_hwframe+0x72/0xdc

Fix the UAF by simply doing nothing in svc_tcp_listen_data_ready()
if state != TCP_LISTEN, that will avoid dereferencing svsk for all
child socket.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/42725e5c1b181b757ba11d[PII_REDACTED]82334d9b; https://git.kernel.org/stable/c/7e1f989055622fd086c5dfb291fc72adf5660b6f; https://git.kernel.org/stable/c/c7b8c2d06e437639694abe76978e915cfb73f428
CVE: CVE-2024-39732
Published: 2024-07-14
Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user.  IBM X-Force ID:  295791.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-316, CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/295791; https://www.ibm.com/support/pages/node/7160185; https://exchange.xforce.ibmcloud.com/vulnerabilities/295791