deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-46960
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: Return correct error code from smb2_get_enc_key

Avoid a warning if the error percolates back up:

[[PII_REDACTED]76] CIFS VFS: \\otters.example.com crypt_message: Could not get encryption key
[[PII_REDACTED]47] ------------[ cut here ]------------
[[PII_REDACTED]48] err = 1
[[PII_REDACTED]77] WARNING: CPU: 11 PID: 2733 at /build/linux-hwe-5.4-p6lk6L/linux-hwe-5.4-5.4.0/lib/errseq.c:74 errseq_set+0x5c/0x70
...
[[PII_REDACTED]04] CPU: 11 PID: 2733 Comm: tar Tainted: G           OE     5.4.0-70-generic #78~18.04.1-Ubuntu
...
[[PII_REDACTED]34] Call Trace:
[[PII_REDACTED]46]  __filemap_set_wb_err+0x1a/0x70
[[PII_REDACTED]19]  cifs_writepages+0x9c7/0xb30 [cifs]
[[PII_REDACTED]26]  do_writepages+0x4b/0xe0
[[PII_REDACTED]44]  __filemap_fdatawrite_range+0xcb/0x100
[[PII_REDACTED]55]  filemap_write_and_wait+0x42/0xa0
[[PII_REDACTED]86]  cifs_setattr+0x68b/0xf30 [cifs]
[[PII_REDACTED]93]  notify_change+0x358/0x4a0
[[PII_REDACTED]00]  utimes_common+0xe9/0x1c0
[[PII_REDACTED]10]  do_utimes+0xc5/0x150
[[PII_REDACTED]20]  __x64_sys_utimensat+0x88/0xd0
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/83728cbf366e334301091d5b808add468ab46b27; https://git.kernel.org/stable/c/93f3339b22ba17e66f[PII_REDACTED]b70ba087eaec; https://git.kernel.org/stable/c/aaa0faa5c28a91c362352d6b35dc3ed10df56fb0
CVE: CVE-2021-46962
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: uniphier-sd: Fix a resource leak in the remove function

A 'tmio_mmc_host_free()' call is missing in the remove function, in order
to balance a 'tmio_mmc_host_alloc()' call in the probe.
This is done in the error handling path of the probe, but not in the remove
function.

Add the missing call.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0d8941b9b2d3e7b3481fdf43b1a6189d162175b7; https://git.kernel.org/stable/c/25ac6ce65f1ab458982d15ec1caf441acd37106a; https://git.kernel.org/stable/c/d6e7fda496978f2763413b5523557b38dc2bf6c2
CVE: CVE-2021-46963
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

    RIP: 0010:kmem_cache_free+0xfa/0x1b0
    Call Trace:
       qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]
       scsi_queue_rq+0x5e2/0xa40
       __blk_mq_try_issue_directly+0x128/0x1d0
       blk_mq_request_issue_directly+0x4e/0xb0

Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now
allocated by upper layers. This fixes smatch warning of srb unintended
free.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6641df81ab799f28a5d564f860233dd26cca0d93; https://git.kernel.org/stable/c/702cdaa2c6283c135ef16d52e0e4e3c1005aa538; https://git.kernel.org/stable/c/77509a[PII_REDACTED]40a42d57c72403f7d4c89a8f
CVE: CVE-2021-46964
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Reserve extra IRQ vectors

Commit a6dcfe08487e ("scsi: qla2xxx: Limit interrupt vectors to number of
CPUs") lowers the number of allocated MSI-X vectors to the number of CPUs.

That breaks vector allocation assumptions in qla83xx_iospace_config(),
qla24xx_enable_msix() and qla2x00_iospace_config(). Either of the functions
computes maximum number of qpairs as:

  ha->max_qpairs = ha->msix_count - 1 (MB interrupt) - 1 (default
                   response queue) - 1 (ATIO, in dual or pure target mode)

max_qpairs is set to zero in case of two CPUs and initiator mode. The
number is then used to allocate ha->queue_pair_map inside
qla2x00_alloc_queues(). No allocation happens and ha->queue_pair_map is
left NULL but the driver thinks there are queue pairs available.

qla2xxx_queuecommand() tries to find a qpair in the map and crashes:

  if (ha->mqenable) {
          uint32_t tag;
          uint16_t hwq;
          struct qla_qpair *qpair = NULL;

          tag = blk_mq_unique_tag(cmd->request);
          hwq = blk_mq_unique_tag_to_hwq(tag);
          qpair = ha->queue_pair_map[hwq]; # <- HERE

          if (qpair)
                  return qla2xxx_mqueuecommand(host, cmd, qpair);
  }

  BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP PTI
  CPU: 0 PID: 72 Comm: kworker/u4:3 Tainted: G        W         5.10.0-rc1+ #25
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
  Workqueue: scsi_wq_7 fc_scsi_scan_rport [scsi_transport_fc]
  RIP: 0010:qla2xxx_queuecommand+0x16b/0x3f0 [qla2xxx]
  Call Trace:
   scsi_queue_rq+0x58c/0xa60
   blk_mq_dispatch_rq_list+0x2b7/0x6f0
   ? __sbitmap_get_word+0x2a/0x80
   __blk_mq_sched_dispatch_requests+0xb8/0x170
   blk_mq_sched_dispatch_requests+0x2b/0x50
   __blk_mq_run_hw_queue+0x49/0xb0
   __blk_mq_delay_run_hw_queue+0xfb/0x150
   blk_mq_sched_insert_request+0xbe/0x110
   blk_execute_rq+0x45/0x70
   __scsi_execute+0x10e/0x250
   scsi_probe_and_add_lun+0x228/0xda0
   __scsi_scan_target+0xf4/0x620
   ? __pm_runtime_resume+0x4f/0x70
   scsi_scan_target+0x100/0x110
   fc_scsi_scan_rport+0xa1/0xb0 [scsi_transport_fc]
   process_one_work+0x1ea/0x3b0
   worker_thread+0x28/0x3b0
   ? process_one_work+0x3b0/0x3b0
   kthread+0x112/0x130
   ? kthread_park+0x80/0x80
   ret_from_fork+0x22/0x30

The driver should allocate enough vectors to provide every CPU it's own HW
queue and still handle reserved (MB, RSP, ATIO) interrupts.

The change fixes the crash on dual core VM and prevents unbalanced QP
allocation where nr_hw_queues is two less than the number of CPUs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0f86d66b38501e3ac66cf2d9f9f8ad6838bad0e6; https://git.kernel.org/stable/c/4ecd42dec858b6632c5f024fe13e9ad6c30f2734; https://git.kernel.org/stable/c/f02d4086a8f36a0e1aaebf559b54cf24a177a486
CVE: CVE-2021-46965
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: physmap: physmap-bt1-rom: Fix unintentional stack access

Cast &data to (char *) in order to avoid unintentionally accessing
the stack.

Notice that data is of type u32, so any increment to &data
will be in the order of 4-byte chunks, and this piece of code
is actually intended to be a byte offset.

Addresses-Coverity-ID: 1497765 ("Out-of-bounds access")
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/34ec706bf0b7c4ca249a729c1bcb91f706c7a7be; https://git.kernel.org/stable/c/4d786870e3262ec098a3b4ed10b895176bc66ecb; https://git.kernel.org/stable/c/4e4ebb827bf09311469ffd9d0c14ed40ed9747aa
CVE: CVE-2021-46966
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ACPI: custom_method: fix potential use-after-free issue

In cm_write(), buf is always freed when reaching the end of the
function.  If the requested count is less than table.length, the
allocated buffer will be freed but subsequent calls to cm_write() will
still try to access it.

Remove the unconditional kfree(buf) at the end of the function and
set the buf to NULL in the -EINVAL error path to match the rest of
function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1d53ca5d131074c925ce38361fb0376d3bf7e394; https://git.kernel.org/stable/c/62dc2440ebb552aa0d7f635e1697e077d9d21203; https://git.kernel.org/stable/c/72814a94c38a33239793f7622cec6ace1e540c4b
CVE: CVE-2021-46967
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

vhost-vdpa: fix vm_flags for virtqueue doorbell mapping

The virtqueue doorbell is usually implemented via registeres but we
don't provide the necessary vma->flags like VM_PFNMAP. This may cause
several issues e.g when userspace tries to map the doorbell via vhost
IOTLB, kernel may panic due to the page is not backed by page
structure. This patch fixes this by setting the necessary
vm_flags. With this patch, try to map doorbell via IOTLB will fail
with bad address.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44; https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6; https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce
CVE: CVE-2021-46968
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: fix zcard and zqueue hot-unplug memleak

Tests with kvm and a kmemdebug kernel showed, that on hot unplug the
zcard and zqueue structs for the unplugged card or queue are not
properly freed because of a mismatch with get/put for the embedded
kref counter.

This fix now adjusts the handling of the kref counters. With init the
kref counter starts with 1. This initial value needs to drop to zero
with the unregister of the card or queue to trigger the release and
free the object.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/026499a9c2e002e621ad568d1378324ae97e5524; https://git.kernel.org/stable/c/055a063a18bcd19b93709e3eac8078d6b2f04599; https://git.kernel.org/stable/c/70fac8088cfad9f3b379c9082832b4d7532c16c2
CVE: CVE-2021-46969
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: core: Fix invalid error returning in mhi_queue

mhi_queue returns an error when the doorbell is not accessible in
the current state. This can happen when the device is in non M0
state, like M3, and needs to be waken-up prior ringing the DB. This
case is managed earlier by triggering an asynchronous M3 exit via
controller resume/suspend callbacks, that in turn will cause M0
transition and DB update.

So, since it's not an error but just delaying of doorbell update, there
is no reason to return an error.

This also fixes a use after free error for skb case, indeed a caller
queuing skb will try to free the skb if the queueing fails, but in
that case queueing has been done.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0ecc1c70dcd32c0f081b173a1a5d89952686f271; https://git.kernel.org/stable/c/a99b661c3187365f81026d89b1133a76cd2652b3; https://git.kernel.org/stable/c/0ecc1c70dcd32c0f081b173a1a5d89952686f271
CVE: CVE-2021-46970
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: pci_generic: Remove WQ_MEM_RECLAIM flag from state workqueue

A recent change created a dedicated workqueue for the state-change work
with WQ_HIGHPRI (no strong reason for that) and WQ_MEM_RECLAIM flags,
but the state-change work (mhi_pm_st_worker) does not guarantee forward
progress under memory pressure, and will even wait on various memory
allocations when e.g. creating devices, loading firmware, etc... The
work is then not part of a memory reclaim path...

Moreover, this causes a warning in check_flush_dependency() since we end
up in code that flushes a non-reclaim workqueue:

[   40.969601] workqueue: WQ_MEM_RECLAIM mhi_hiprio_wq:mhi_pm_st_worker [mhi] is flushing !WQ_MEM_RECLAIM events_highpri:flush_backlog
[   40.969612] WARNING: CPU: 4 PID: 158 at kernel/workqueue.c:2607 check_flush_dependency+0x11c/0x140
[   40.969733] Call Trace:
[   40.969740]  __flush_work+0x97/0x1d0
[   40.969745]  ? wake_up_process+0x15/0x20
[   40.969749]  ? insert_work+0x70/0x80
[   40.969750]  ? __queue_work+0x14a/0x3e0
[   40.969753]  flush_work+0x10/0x20
[   40.969756]  rollback_registered_many+0x1c9/0x510
[   40.969759]  unregister_netdevice_queue+0x94/0x120
[   40.969761]  unregister_netdev+0x1d/0x30
[   40.969765]  mhi_net_remove+0x1a/0x40 [mhi_net]
[   40.969770]  mhi_driver_remove+0x124/0x250 [mhi]
[   40.969776]  device_release_driver_internal+0xf0/0x1d0
[   40.969778]  device_release_driver+0x12/0x20
[   40.969782]  bus_remove_device+0xe1/0x150
[   40.969786]  device_del+0x17b/0x3e0
[   40.969791]  mhi_destroy_device+0x9a/0x100 [mhi]
[   40.969796]  ? mhi_unmap_single_use_bb+0x50/0x50 [mhi]
[   40.969799]  device_for_each_child+0x5e/0xa0
[   40.969804]  mhi_pm_st_worker+0x921/0xf50 [mhi]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0fccbf0a3b690b162f53b13ed8bc442ea33437dc; https://git.kernel.org/stable/c/abd1510c08a13c88d24b622a83c82e87ff1d3135; https://git.kernel.org/stable/c/ed541cff35cbdb695f0c98ef506dd7218883fc07
CVE: CVE-2021-46971
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix unconditional security_locked_down() call

Currently, the lockdown state is queried unconditionally, even though
its result is used only if the PERF_SAMPLE_REGS_INTR bit is set in
attr.sample_type. While that doesn't matter in case of the Lockdown LSM,
it causes trouble with the SELinux's lockdown hook implementation.

SELinux implements the locked_down hook with a check whether the current
task's type has the corresponding "lockdown" class permission
("integrity" or "confidentiality") allowed in the policy. This means
that calling the hook when the access control decision would be ignored
generates a bogus permission check and audit record.

Fix this by checking sample_type first and only calling the hook when
its result would be honored.
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/08ef1af4de5fe7de9c6d69f1e22e51b66e385d9b; https://git.kernel.org/stable/c/4348d3b5027bc3ff6336368b6c60605d4ef8e1ce; https://git.kernel.org/stable/c/b246759284d6a2bc5b6f1009caeeb3abce2ec9ff
CVE: CVE-2021-46972
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ovl: fix leaked dentry

Since commit 6815f479ca90 ("ovl: use only uppermetacopy state in
ovl_lookup()"), overlayfs doesn't put temporary dentry when there is a
metacopy error, which leads to dentry leaks when shutting down the related
superblock:

  overlayfs: refusing to follow metacopy origin for (/file0)
  ...
  BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]
  ...
  WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d
  CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1
  ...
  RIP: 0010:umount_check.cold+0x107/0x14d
  ...
  Call Trace:
   d_walk+0x28c/0x950
   ? dentry_lru_isolate+0x2b0/0x2b0
   ? __kasan_slab_free+0x12/0x20
   do_one_tree+0x33/0x60
   shrink_dcache_for_umount+0x78/0x1d0
   generic_shutdown_super+0x70/0x440
   kill_anon_super+0x3e/0x70
   deactivate_locked_super+0xc4/0x160
   deactivate_super+0xfa/0x140
   cleanup_mnt+0x22e/0x370
   __cleanup_mnt+0x1a/0x30
   task_work_run+0x139/0x210
   do_exit+0xb0c/0x2820
   ? __kasan_check_read+0x1d/0x30
   ? find_held_lock+0x35/0x160
   ? lock_release+0x1b6/0x660
   ? mm_update_next_owner+0xa20/0xa20
   ? reacquire_held_locks+0x3f0/0x3f0
   ? __sanitizer_cov_trace_const_cmp4+0x22/0x30
   do_group_exit+0x135/0x380
   __do_sys_exit_group.isra.0+0x20/0x20
   __x64_sys_exit_group+0x3c/0x50
   do_syscall_64+0x45/0x70
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  ...
  VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

This fix has been tested with a syzkaller reproducer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/71d58457a8afc650da5d3292a7f[PII_REDACTED]d95; https://git.kernel.org/stable/c/cf3e3330bc5719fa9d658e3e2f596bde89344a94; https://git.kernel.org/stable/c/d587cfaef72b1b6f4b[PII_REDACTED]bce91f497cc8
CVE: CVE-2021-46973
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: Avoid potential use after free in MHI send

It is possible that the MHI ul_callback will be invoked immediately
following the queueing of the skb for transmission, leading to the
callback decrementing the refcount of the associated sk and freeing the
skb.

As such the dereference of skb and the increment of the sk refcount must
happen before the skb is queued, to avoid the skb to be used after free
and potentially the sk to drop its last refcount..
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/03c649dee8b1eb5600212a249542a70f47a5ab40; https://git.kernel.org/stable/c/47a017f[PII_REDACTED]0c072bc71681809b2567b3a; https://git.kernel.org/stable/c/48ec949ac979b4b42d740f67b6177797af834f80
CVE: CVE-2021-46974
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix masking negation logic upon negative dst register

The negation logic for the case where the off_reg is sitting in the
dst register is not correct given then we cannot just invert the add
to a sub or vice versa. As a fix, perform the final bitwise and-op
unconditionally into AX from the off_reg, then move the pointer from
the src to dst and finally use AX as the source for the original
pointer arithmetic operation such that the inversion yields a correct
result. The single non-AX mov in between is possible given constant
blinding is retaining it as it's not an immediate based operation.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0e2dfdc74a7f[PII_REDACTED]d42ea59388f153f42c; https://git.kernel.org/stable/c/2cfa537674cd1051a3b8111536d77d0558f33d5d; https://git.kernel.org/stable/c/4d542ddb88fb2f39bf7f14caa2902f3e8d06f6ba
CVE: CVE-2021-46975
Published: 2024-02-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-27099
Published: 2024-02-27
Description: The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-415
References: https://github.com/Azure/azure-uamqp-c/commit/2ca42b6e4e098af2d17e487814a91d05f6ae4987; https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-6rh4-fj44-v4jj; https://github.com/Azure/azure-uamqp-c/commit/2ca42b6e4e098af2d17e487814a91d05f6ae4987
CVE: CVE-2024-24027
Published: 2024-02-27
Description: SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic::getFansLists.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://samyueru.substack.com/p/cve-2024-24027-sql-injection-trong-likeshop; https://samyueru.substack.com/p/cve-2024-24027-sql-injection-trong-likeshop
CVE: CVE-2024-0763
Published: 2024-02-27
Description: Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need access to the server at some privilege level since this endpoint is protected and requires authorization.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/mintplex-labs/anything-llm/commit/8a7324d0e77a15186e1ad5e5119fca4fb224c39c; https://huntr.com/bounties/25a2f487-5a9c-4c7f-a2d3-b0527db73ea5; https://github.com/mintplex-labs/anything-llm/commit/8a7324d0e77a15186e1ad5e5119fca4fb224c39c
CVE: CVE-2024-1864
Published: 2024-02-27
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2813. Reason: This candidate is a duplicate of CVE-2023-2813. Notes: All CVE users should reference CVE-2023-2813 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-1865
Published: 2024-02-27
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2813. Reason: This candidate is a duplicate of CVE-2023-2813. Notes: All CVE users should reference CVE-2023-2813 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-1866
Published: 2024-02-27
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2813. Reason: This candidate is a duplicate of CVE-2023-2813. Notes: All CVE users should reference CVE-2023-2813 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-26294
Published: 2024-02-27
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt
CVE: CVE-2024-26295
Published: 2024-02-27
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt
CVE: CVE-2024-26296
Published: 2024-02-27
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt
CVE: CVE-2024-26297
Published: 2024-02-27
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt
CVE: CVE-2024-26298
Published: 2024-02-27
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt
CVE: CVE-2024-26299
Published: 2024-02-27
Description: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt
CVE: CVE-2024-26542
Published: 2024-02-27
Description: Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/c0d3x27/CVEs/blob/main/CVE-2024-26542/README.md; https://github.com/c0d3x27/CVEs/blob/main/CVE-2024-26542/README.md