deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2056
Published: 2024-03-05
Description: Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service is running, running as the root user, is bound to the loopback interface, and is listening on TCP port 7050. Security issues associated with exposing this network service are documented at gvalkov's 'tailon' GitHub repo. Using the tailon service, the contents of any file on the Artica Proxy can be viewed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-552
References: http://seclists.org/fulldisclosure/2024/Mar/14; https://github.com/gvalkov/tailon#security; https://korelogic.com/Resources/Advisories/KL-001-2024-004.txt
CVE: CVE-2024-1356
Published: 2024-03-05
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE: CVE-2024-25611
Published: 2024-03-05
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE: CVE-2024-25612
Published: 2024-03-05
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE: CVE-2024-25613
Published: 2024-03-05
Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE: CVE-2024-25614
Published: 2024-03-05
Description: There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to denial-of-service conditions and impact the integrity of the controller. 


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE: CVE-2024-25615
Published: 2024-03-05
Description:  An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE: CVE-2024-25616
Published: 2024-03-05
Description: Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKE_AUTH negotiation process. The scenarios in which disclosure of potentially sensitive information can occur are complex, and depend on factors beyond the control of attackers.


CVSS Score: 3.7 (LOW)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE: CVE-2024-25858
Published: 2024-03-05
Description: In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt message for users to review parameters of commands.
CVSS Score: 8.4 (HIGH)
CWE: CWE-450
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-2179
Published: 2024-03-05
Description: Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Name field which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.2 with a vector of AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N  Concrete versions below 9 do not include group types so they are not affected by this vulnerability. Thanks Luca Fuda for reporting.
CVSS Score: 2.2 (LOW)
CWE: CWE-79, CWE-79
References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/927-release-notes; https://documentation.concretecms.org/9-x/developers/introduction/version-history/927-release-notes
CVE: CVE-2024-1764
Published: 2024-03-05
Description: Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated privilege even after the expiration under specific circumstances



CVSS Score: 7.6 (HIGH)
CWE: CWE-269
References: https://devolutions.net/security/advisories/DEVO-2024-0002; https://devolutions.net/security/advisories/DEVO-2024-0002
CVE: CVE-2024-1898
Published: 2024-03-05
Description: Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings configured by an administrator.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2024-0002; https://devolutions.net/security/advisories/DEVO-2024-0002
CVE: CVE-2024-1900
Published: 2024-03-05
Description: Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. 

The user will stay authenticated until the Devolutions Server token expiration.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-613
References: https://devolutions.net/security/advisories/DEVO-2024-0002; https://devolutions.net/security/advisories/DEVO-2024-0002
CVE: CVE-2024-1901
Published: 2024-03-05
Description: Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable.



CVSS Score: 4.3 (MEDIUM)
References: https://devolutions.net/security/advisories/DEVO-2024-0002; https://devolutions.net/security/advisories/DEVO-2024-0002
CVE: CVE-2023-45289
Published: 2024-03-05
Description: When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/03/08/4; https://go.dev/cl/569340; https://go.dev/issue/65065
CVE: CVE-2023-45290
Published: 2024-03-05
Description: When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2024/03/08/4; https://go.dev/cl/569341; https://go.dev/issue/65383
CVE: CVE-2023-48644
Published: 2024-03-05
Description: An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644; https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644; https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644
CVE: CVE-2024-24275
Published: 2024-03-05
Description: Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the global search function.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/; https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/
CVE: CVE-2024-24276
Published: 2024-03-05
Description: Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/; https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/
CVE: CVE-2024-24278
Published: 2024-03-05
Description: An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/; https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/
CVE: CVE-2024-24783
Published: 2024-03-05
Description: Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2024/03/08/4; https://go.dev/cl/569339; https://go.dev/issue/65390
CVE: CVE-2024-24784
Published: 2024-03-05
Description: The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2024/03/08/4; https://go.dev/cl/555596; https://go.dev/issue/65083
CVE: CVE-2024-24785
Published: 2024-03-05
Description: If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
CVSS Score: 5.4 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/03/08/4; https://go.dev/cl/564196; https://go.dev/issue/65697
CVE: CVE-2024-24786
Published: 2024-03-05
Description: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2024/03/08/4; https://go.dev/cl/569356; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/
CVE: CVE-2024-27764
Published: 2024-03-05
Description: An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-27
References: https://gitee.com/erzhongxmu/JEEWMS/issues/I8YN90; https://gitee.com/erzhongxmu/JEEWMS/issues/I8YN90
CVE: CVE-2024-27765
Published: 2024-03-05
Description: Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://gitee.com/erzhongxmu/JEEWMS/issues/I8YN90; https://gitee.com/erzhongxmu/JEEWMS/issues/I8YN90
CVE: CVE-2023-38944
Published: 2024-03-06
Description: An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access control and gain complete access to the application via modifying a HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://seclists.org/fulldisclosure/2024/Mar/0; http://seclists.org/fulldisclosure/2024/Mar/0; https://seclists.org/fulldisclosure/2024/Mar/0
CVE: CVE-2023-38945
Published: 2024-03-06
Description: Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows attackers to bypass the access control and gain complete access to the application via supplying a crafted URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2024/Mar/1; http://seclists.org/fulldisclosure/2024/Mar/1; http://seclists.org/fulldisclosure/2024/Mar/2
CVE: CVE-2023-38946
Published: 2024-03-06
Description: An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complete access to the application via supplying a crafted cookie.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2024/Mar/2; http://seclists.org/fulldisclosure/2024/Mar/2
CVE: CVE-2023-43318
Published: 2024-03-06
Description: TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/str2ver/CVE-2023-43318/tree/main; https://seclists.org/fulldisclosure/2024/Mar/9; https://seclists.org/fulldisclosure/2024/Mar/9
CVE: CVE-2024-22889
Published: 2024-03-06
Description: Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276, CWE-276
References: https://github.com/shenhav12/CVE-2024-22889-Plone-v6.0.9; https://github.com/shenhav12/CVE-2024-22889-Plone-v6.0.9
CVE: CVE-2024-25817
Published: 2024-03-06
Description: Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/advisories/GHSA-3qx3-6hxr-j2ch; https://www.cubeyond.net/blog/my-cves/eza-cve-report; https://github.com/advisories/GHSA-3qx3-6hxr-j2ch
CVE: CVE-2024-27278
Published: 2024-03-06
Description: OpenPNE Plugin "opTimelinePlugin" 1.2.11 and earlier contains a cross-site scripting vulnerability. On the site which uses the affected product, when a user configures the profile with some malicious contents, an arbitrary script may be executed on the web browsers of other users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openpne.jp/archives/13458/; https://jvn.jp/en/jp/JVN78084105/; http://www.openpne.jp/archives/13458/
CVE: CVE-2023-33677
Published: 2024-03-06
Description: Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*".
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://wwwsourcecodestercom.com; https://github.com/ASR511-OO7/CVE-2023-33677/blob/main/CVE-29; http://wwwsourcecodestercom.com
CVE: CVE-2023-49971
Published: 2024-03-06
Description: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter at /customer_support/index.php?page=customer_list.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49971; https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html; https://github.com/geraldoalcantara/CVE-2023-49971
CVE: CVE-2023-49973
Published: 2024-03-06
Description: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter at /customer_support/index.php?page=customer_list.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49973; https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html; https://github.com/geraldoalcantara/CVE-2023-49973
CVE: CVE-2023-49974
Published: 2024-03-06
Description: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contact parameter at /customer_support/index.php?page=customer_list.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49974; https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html; https://github.com/geraldoalcantara/CVE-2023-49974
CVE: CVE-2023-49976
Published: 2024-03-06
Description: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the subject parameter at /customer_support/index.php?page=new_ticket.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49976; https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html; https://github.com/geraldoalcantara/CVE-2023-49976
CVE: CVE-2023-49977
Published: 2024-03-06
Description: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the address parameter at /customer_support/index.php?page=new_customer.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49977; https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html; https://github.com/geraldoalcantara/CVE-2023-49977
CVE: CVE-2024-1220
Published: 2024-03-06
Description: A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit the vulnerability by sending crafted payload to the web service. Successful exploitation of the vulnerability could result in denial of service.


CVSS Score: 8.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-238975-nport-w2150a-w2250a-series-web-server-stack-based-buffer-overflow-vulnerability; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-238975-nport-w2150a-w2250a-series-web-server-stack-based-buffer-overflow-vulnerability
CVE: CVE-2024-1760
Published: 2024-03-06
Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. This is due to missing or incorrect nonce validation on the ssa_factory_reset() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-support.php#L527; https://plugins.trac.wordpress.org/changeset/3042890/simply-schedule-appointments/trunk/includes/class-support.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0eec9744-6dbd-42bd-b9c5-c9d792cecf4b?source=cve
CVE: CVE-2024-1771
Published: 2024-03-06
Description: The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in all versions up to, and including, 2.1.59. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeat sections on the homepage.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://themes.trac.wordpress.org/browser/total/2.1.59/inc/customizer/customizer-functions.php#L112; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=219020%40total%2F2.1.60&old=216973%40total%2F2.1.59; https://www.wordfence.com/threat-intel/vulnerabilities/id/26b64ae3-5839-47d5-9c65-7c595bb18e6c?source=cve
CVE: CVE-2024-1989
Published: 2024-03-06
Description: The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Sassy_Social_Share' shortcode in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping on user supplied attributes such as 'url'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/sassy-social-share/trunk/includes/class-sassy-social-share-sharing-networks.php#L65; https://plugins.trac.wordpress.org/browser/sassy-social-share/trunk/includes/class-sassy-social-share-shortcodes.php#L228; https://plugins.trac.wordpress.org/browser/sassy-social-share/trunk/includes/class-sassy-social-share-shortcodes.php#L308
CVE: CVE-2023-52583
Published: 2024-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

ceph: fix deadlock or deadcode of misusing dget()

The lock order is incorrect between denty and its parent, we should
always make sure that the parent get the lock first.

But since this deadcode is never used and the parent dir will always
be set from the callers, let's just remove it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/196b87e5c00ce021e164a5de0f0d04f4116a9160; https://git.kernel.org/stable/c/6ab4fd508fad942f1f1ba940492f2735e078e980; https://git.kernel.org/stable/c/76cb2aa3421fee4fde706dec41b1344bc0a9ad67