deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5040
Published: 2024-05-21
Description: There are multiple ways in 
LCDS LAquis SCADA for an attacker to access locations outside of their own directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-142-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-142-01
CVE: CVE-2024-21683
Published: 2024-05-21
Description: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. 

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html

You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives.

This vulnerability was found internally.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/CONFSERVER-95832
CVE: CVE-2024-3518
Published: 2024-05-22
Description: The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-custom-list.php#L1971; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069819%40media-library-assistant%2Ftrunk&old=3060779%40media-library-assistant%2Ftrunk&sfp_email=&sfph_mail=#file3; https://www.wordfence.com/threat-intel/vulnerabilities/id/a7af1a03-8382-4593-a41f-8cdb1bb9e53b?source=cve
CVE: CVE-2024-3519
Published: 2024-05-22
Description: The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-87, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069819%40media-library-assistant%2Ftrunk&old=3060779%40media-library-assistant%2Ftrunk&sfp_email=&sfph_mail=#file3; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e1cdaf3-76fe-4b73-b30b-4554f0d34d11?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069819%40media-library-assistant%2Ftrunk&old=3060779%40media-library-assistant%2Ftrunk&sfp_email=&sfph_mail=#file3
CVE: CVE-2024-5190
Published: 2024-05-22
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-0451
Published: 2024-05-22
Description: The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to list files existing in a linked OpenAI account.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/browser/chatbot/trunk/includes/openai/qcld-bot-openai.php#L175; https://plugins.trac.wordpress.org/changeset/3089461/chatbot/trunk/includes/openai/qcld-bot-openai.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0572a5-6cc9-43ab-a4a3-c8d3b93c8fcf?source=cve
CVE: CVE-2024-0452
Published: 2024-05-22
Description: The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files to a linked OpenAI account.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/browser/chatbot/trunk/includes/openai/qcld-bot-openai.php#L208; https://plugins.trac.wordpress.org/changeset/3089461/chatbot/trunk/includes/openai/qcld-bot-openai.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/34b6475c-b5dd-42a1-98d1-9b5ae9ff4ad5?source=cve
CVE: CVE-2024-0453
Published: 2024-05-22
Description: The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete files from a linked OpenAI account.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/browser/chatbot/trunk/includes/openai/qcld-bot-openai.php#L133; https://plugins.trac.wordpress.org/changeset/3089461/chatbot/trunk/includes/openai/qcld-bot-openai.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0ef4a5-42d7-4cea-b19f-51917e3ee55f?source=cve
CVE: CVE-2024-30419
Published: 2024-05-22
Description: Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with a contributor or higher privilege who can log in to the product may execute an arbitrary script on the web browser of the user who accessed the website using the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://developer.a-blogcms.jp/blog/news/JVN-70977403.html; https://jvn.jp/en/jp/JVN70977403/; https://developer.a-blogcms.jp/blog/news/JVN-70977403.html
CVE: CVE-2024-30420
Published: 2024-05-22
Description: Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://developer.a-blogcms.jp/blog/news/JVN-70977403.html; https://jvn.jp/en/jp/JVN70977403/; https://developer.a-blogcms.jp/blog/news/JVN-70977403.html
CVE: CVE-2024-31394
Published: 2024-05-22
Description: Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may obtain arbitrary files on the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://developer.a-blogcms.jp/blog/news/JVN-70977403.html; https://jvn.jp/en/jp/JVN70977403/; https://developer.a-blogcms.jp/blog/news/JVN-70977403.html
CVE: CVE-2024-31395
Published: 2024-05-22
Description: Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may execute an arbitrary script on the web browser of the user who accessed the schedule management page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.a-blogcms.jp/blog/news/JVN-70977403.html; https://jvn.jp/en/jp/JVN70977403/; https://developer.a-blogcms.jp/blog/news/JVN-70977403.html
CVE: CVE-2024-31396
Published: 2024-05-22
Description: Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an arbitrary command on the server.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://developer.a-blogcms.jp/blog/news/JVN-70977403.html; https://jvn.jp/en/jp/JVN70977403/; https://developer.a-blogcms.jp/blog/news/JVN-70977403.html
CVE: CVE-2024-4980
Published: 2024-05-22
Description: The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id', 'mixColor', 'backgroundColor', 'saveInCookies', and 'autoMatchOsTheme' parameters in all versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpkoi-templates-for-elementor/trunk/elements/elements/advanced-heading/advanced-heading.php#L626; https://plugins.trac.wordpress.org/browser/wpkoi-templates-for-elementor/trunk/elements/elements/darkmode/darkmode.php#L291; https://plugins.trac.wordpress.org/browser/wpkoi-templates-for-elementor/trunk/elements/elements/qr-code/qr-code.php#L110
CVE: CVE-2020-35165
Published: 2024-05-22
Description: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities
CVE: CVE-2024-31340
Published: 2024-05-22
Description: TP-Link Tether versions prior to 4.5.13 and TP-Link Tapo versions prior to 3.3.6 do not properly validate certificates, which may allow a remote unauthenticated attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://jvn.jp/en/jp/JVN29471697/; https://play.google.com/store/apps/details?id=com.tplink.iot; https://play.google.com/store/apps/details?id=com.tplink.tether
CVE: CVE-2024-35162
Published: 2024-05-22
Description: Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switch_themes" privilege may obtain arbitrary files on the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN85380030/; https://wordpress.org/plugins/download-plugins-dashboard/; https://jvn.jp/en/jp/JVN85380030/
CVE: CVE-2024-3066
Published: 2024-05-22
Description: The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wordpress.org/plugins/elegant-addons-for-elementor/; https://www.wordfence.com/threat-intel/vulnerabilities/id/affa8b39-94b8-474d-9310-a93ebdb7c1b8?source=cve; https://wordpress.org/plugins/elegant-addons-for-elementor/
CVE: CVE-2024-3611
Published: 2024-05-22
Description: The Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tbex-version' shortcode in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/toolbar-extras/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/50631f6c-de8b-408e-ab1f-ef74d3180e7f?source=cve; https://wordpress.org/plugins/toolbar-extras/#developers
CVE: CVE-2024-4443
Published: 2024-05-22
Description: The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/business-directory-plugin/trunk/includes/fields/class-fieldtypes-select.php#L110; https://plugins.trac.wordpress.org/changeset/3089626/; https://www.wordfence.com/threat-intel/vulnerabilities/id/982fb304-08d6-4195-97a3-f18e94295492?source=cve
CVE: CVE-2024-4971
Published: 2024-05-22
Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wordpress.org/plugins/learnpress/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/10b08a05-3561-4d05-985b-6a2339a547a7?source=cve; https://wordpress.org/plugins/learnpress/#developers
CVE: CVE-2024-5092
Published: 2024-05-22
Description: The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Switcher, Slider, and Iconbox widgets in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/elegant-addons-for-elementor/trunk/widgets/eae-iconbox.php#L1667; https://plugins.trac.wordpress.org/browser/elegant-addons-for-elementor/trunk/widgets/eae-slider.php#L1091; https://plugins.trac.wordpress.org/browser/elegant-addons-for-elementor/trunk/widgets/eae-switcher.php#L516
CVE: CVE-2021-47433
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix abort logic in btrfs_replace_file_extents

Error injection testing uncovered a case where we'd end up with a
corrupt file system with a missing extent in the middle of a file.  This
occurs because the if statement to decide if we should abort is wrong.

The only way we would abort in this case is if we got a ret !=
-EOPNOTSUPP and we called from the file clone code.  However the
prealloc code uses this path too.  Instead we need to abort if there is
an error, and the only error we _don't_ abort on is -EOPNOTSUPP and only
if we came from the clone file code.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c; https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378; https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f
CVE: CVE-2021-47434
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

xhci: Fix command ring pointer corruption while aborting a command

The command ring pointer is located at [6:63] bits of the command
ring control register (CRCR). All the control bits like command stop,
abort are located at [0:3] bits. While aborting a command, we read the
CRCR and set the abort bit and write to the CRCR. The read will always
give command ring pointer as all zeros. So we essentially write only
the control bits. Since we split the 64 bit write into two 32 bit writes,
there is a possibility of xHC command ring stopped before the upper
dword (all zeros) is written. If that happens, xHC updates the upper
dword of its internal command ring pointer with all zeros. Next time,
when the command ring is restarted, we see xHC memory access failures.
Fix this issue by only writing to the lower dword of CRCR where all
control bits are located.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/01c2dcb67e71c351006dd17cbba86c26b7f61eaf; https://git.kernel.org/stable/c/22bcb65ea41072ab5d03c0c6290e04e0df6d09a0; https://git.kernel.org/stable/c/62c182b5e763e5f4062e72678e72ce3e02dd4d1b
CVE: CVE-2021-47436
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: musb: dsps: Fix the probe error path

Commit 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after
initializing musb") has inverted the calls to
dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() without
updating correctly the error path. dsps_create_musb_pdev() allocates and
registers a new platform device which must be unregistered and freed
with platform_device_unregister(), and this is missing upon
dsps_setup_optional_vbus_irq() error.

While on the master branch it seems not to trigger any issue, I observed
a kernel crash because of a NULL pointer dereference with a v5.10.70
stable kernel where the patch mentioned above was backported. With this
kernel version, -EPROBE_DEFER is returned the first time
dsps_setup_optional_vbus_irq() is called which triggers the probe to
error out without unregistering the platform device. Unfortunately, on
the Beagle Bone Black Wireless, the platform device still living in the
system is being used by the USB Ethernet gadget driver, which during the
boot phase triggers the crash.

My limited knowledge of the musb world prevents me to revert this commit
which was sent to silence a robot warning which, as far as I understand,
does not make sense. The goal of this patch was to prevent an IRQ to
fire before the platform device being registered. I think this cannot
ever happen due to the fact that enabling the interrupts is done by the
->enable() callback of the platform musb device, and this platform
device must be already registered in order for the core or any other
user to use this callback.

Hence, I decided to fix the error path, which might prevent future
errors on mainline kernels while also fixing older ones.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c; https://git.kernel.org/stable/c/9ab5d539bc975b8dcde86eca1b58d836b657732e; https://git.kernel.org/stable/c/9d89e287116796bf987cc48f5c8632ef3048f8eb
CVE: CVE-2021-47437
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: adis16475: fix deadlock on frequency set

With commit 39c024b51b560
("iio: adis16475: improve sync scale mode handling"), two deadlocks were
introduced:
 1) The call to 'adis_write_reg_16()' was not changed to it's unlocked
    version.
 2) The lock was not being released on the success path of the function.

This change fixes both these issues.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/04e03b907022ebd876f422f17efcc2c6cc934dc6; https://git.kernel.org/stable/c/9da1b86865ab4376408c58cd9fec332c8bdb5c73; https://git.kernel.org/stable/c/04e03b907022ebd876f422f17efcc2c6cc934dc6
CVE: CVE-2021-47438
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path

Prior to this patch in case mlx5_core_destroy_cq() failed it returns
without completing all destroy operations and that leads to memory leak.
Instead, complete the destroy flow before return error.

Also move mlx5_debug_cq_remove() to the beginning of mlx5_core_destroy_cq()
to be symmetrical with mlx5_core_create_cq().

kmemleak complains on:

unreferenced object 0xc[PII_REDACTED]25100 (size 64):
  comm "ethtool", pid 28301, jiffies[PII_REDACTED] (age 785.380s)
  hex dump (first 32 bytes):
    60 01 48 94 00 00 00 c0 b8 05 34 c3 00 00 00 c0  `.H.......4.....
    02 00 00 00 00 00 00 00 00 db 7d c1 00 00 00 c0  ..........}.....
  backtrace:
    [<000000009e8643cb>] add_res_tree+0xd0/0x270 [mlx5_core]
    [<00000000e7cb8e6c>] mlx5_debug_cq_add+0x5c/0xc0 [mlx5_core]
    [<000000002a12918f>] mlx5_core_create_cq+0x1d0/0x2d0 [mlx5_core]
    [<00000000cef0a696>] mlx5e_create_cq+0x210/0x3f0 [mlx5_core]
    [<000000009c642c26>] mlx5e_open_cq+0xb4/0x130 [mlx5_core]
    [<[PII_REDACTED]dfa578>] mlx5e_ptp_open+0x7f4/0xe10 [mlx5_core]
    [<[PII_REDACTED]>] mlx5e_open_channels+0x9cc/0x13e0 [mlx5_core]
    [<[PII_REDACTED]cf05d4>] mlx5e_switch_priv_channels+0xa4/0x230
[mlx5_core]
    [<[PII_REDACTED]bbedd8>] mlx5e_safe_switch_params+0x14c/0x300
[mlx5_core]
    [<[PII_REDACTED]bc9db8>] set_pflag_tx_port_ts+0x9c/0x160 [mlx5_core]
    [<00000000a0553443>] mlx5e_set_priv_flags+0xd0/0x1b0 [mlx5_core]
    [<00000000a8f3d84b>] ethnl_set_privflags+0x234/0x2d0
    [<00000000fd27f27c>] genl_family_rcv_msg_doit+0x108/0x1d0
    [<00000000f495e2bb>] genl_family_rcv_msg+0xe4/0x1f0
    [<[PII_REDACTED]6c5c2c>] genl_rcv_msg+0x78/0x120
    [<00000000d53e384e>] netlink_rcv_skb+0x74/0x1a0
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/4f7bddf8c5c01cac74373443b13a68e1c6723a94; https://git.kernel.org/stable/c/94b960b9deffc02fc0747afc01f72cc62ab099e3; https://git.kernel.org/stable/c/ed8aafea4fec9c654e63445236e0b505e27ed3a7