deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-32547
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Bond Code Insert Manager (Q2W3 Inc Manager) allows Reflected XSS.This issue affects Code Insert Manager (Q2W3 Inc Manager): from n/a through 2.5.3.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/q2w3-inc-manager/wordpress-code-insert-manager-q2w3-inc-manager-plugin-2-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/q2w3-inc-manager/wordpress-code-insert-manager-q2w3-inc-manager-plugin-2-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32548
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hideki Tanaka What's New Generator allows Stored XSS.This issue affects What's New Generator: from n/a through 2.0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/whats-new-genarator/wordpress-what-s-new-generator-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/whats-new-genarator/wordpress-what-s-new-generator-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32549
Published: 2024-04-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Microkid Related Posts for WordPress allows Cross-Site Scripting (XSS).This issue affects Related Posts for WordPress: from n/a through 4.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/microkids-related-posts/wordpress-related-posts-for-wordpress-plugin-4-0-3-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/microkids-related-posts/wordpress-related-posts-for-wordpress-plugin-4-0-3-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32550
Published: 2024-04-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in BMI Adult & Kid Calculator allows Stored XSS.This issue affects BMI Adult & Kid Calculator: from n/a through 1.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bmi-adultkid-calculator/wordpress-bmi-adult-kid-calculator-plugin-1-2-1-broken-access-control-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bmi-adultkid-calculator/wordpress-bmi-adult-kid-calculator-plugin-1-2-1-broken-access-control-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-3832
Published: 2024-04-17
Description: Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/331358160; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3833
Published: 2024-04-17
Description: Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-374
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/331383939; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3834
Published: 2024-04-17
Description: Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/326607008; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3837
Published: 2024-04-17
Description: Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/41491379; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3838
Published: 2024-04-17
Description: Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. (Chromium security severity: Medium)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-358
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/328278717; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3839
Published: 2024-04-17
Description: Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/41491859; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3840
Published: 2024-04-17
Description: Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/41493458; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3841
Published: 2024-04-17
Description: Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-20
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/330376742; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3843
Published: 2024-04-17
Description: Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/41486690; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3844
Published: 2024-04-17
Description: Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-358
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/40058873; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3845
Published: 2024-04-17
Description: Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-358, CWE-1068
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/323583084; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3846
Published: 2024-04-17
Description: Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/40064754; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2024-3847
Published: 2024-04-17
Description: Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-305, CWE-691
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/328690293; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/
CVE: CVE-2023-25043
Published: 2024-04-17
Description: Incorrect Authorization vulnerability in Supsystic Data Tables Generator.This issue affects Data Tables Generator: from n/a through 1.10.25.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://patchstack.com/database/vulnerability/data-tables-generator-by-supsystic/wordpress-data-tables-generator-by-supsystic-plugin-1-10-25-broken-acces-control-vulnerability?_s_id=cve-2023-25043; https://patchstack.com/database/vulnerability/data-tables-generator-by-supsystic/wordpress-data-tables-generator-by-supsystic-plugin-1-10-25-broken-acces-control-vulnerability?_s_id=cve-2023-25043
CVE: CVE-2023-36505
Published: 2024-04-17
Description: Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-contact-form-the-drag-and-drop-form-builder-for-wordpress-plugin-3-6-24-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-contact-form-the-drag-and-drop-form-builder-for-wordpress-plugin-3-6-24-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-24856
Published: 2024-04-17
Description: The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a
successful allocation, but the subsequent code directly dereferences the
pointer that receives it, which may lead to null pointer dereference.

To fix this issue, a null pointer check should be added. If it is null, 
return exception code AE_NO_MEMORY.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=8764; https://bugzilla.openanolis.cn/show_bug.cgi?id=8764
CVE: CVE-2024-32533
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Shaw LH Add Media From Url allows Reflected XSS.This issue affects LH Add Media From Url: from n/a through 1.22.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/lh-add-media-from-url/wordpress-lh-add-media-from-url-plugin-1-22-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lh-add-media-from-url/wordpress-lh-add-media-from-url-plugin-1-22-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32534
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.23.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-plugin-1-15-23-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-plugin-1-15-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32535
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jojaba Access Category Password allows Reflected XSS.This issue affects Access Category Password: from n/a through 1.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/access-category-password/wordpress-access-category-password-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/access-category-password/wordpress-access-category-password-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32536
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Trade Pips WP TradingView allows Stored XSS.This issue affects WP TradingView: from n/a through 1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-tradingview/wordpress-wp-tradingview-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-tradingview/wordpress-wp-tradingview-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32538
Published: 2024-04-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Joshua Eldridge Easy CountDowner allows Stored XSS.This issue affects Easy CountDowner: from n/a through 1.0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/easy-countdowner/wordpress-easy-countdowner-plugin-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-countdowner/wordpress-easy-countdowner-plugin-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32539
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP File Download Light allows Stored XSS.This issue affects WP File Download Light: from n/a through 1.3.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-file-download-light/wordpress-wp-file-download-light-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-file-download-light/wordpress-wp-file-download-light-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32540
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Web357 Fixed HTML Toolbar allows Stored XSS.This issue affects Fixed HTML Toolbar: from n/a through 1.0.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fixed-html-toolbar/wordpress-fixed-html-toolbar-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fixed-html-toolbar/wordpress-fixed-html-toolbar-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32541
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tobias Battenberg WP-Cufon allows Stored XSS.This issue affects WP-Cufon: from n/a through 1.6.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-cufon/wordpress-wp-cufon-plugin-1-6-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-cufon/wordpress-wp-cufon-plugin-1-6-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32542
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bulk-block-converter/wordpress-bulk-block-converter-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bulk-block-converter/wordpress-bulk-block-converter-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32543
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Minoji MJ Update History allows Reflected XSS.This issue affects MJ Update History: from n/a through 1.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mj-update-history/wordpress-mj-update-history-plugin-1-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mj-update-history/wordpress-mj-update-history-plugin-1-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32544
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through 2.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/netgsm/wordpress-netgsm-plugin-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/netgsm/wordpress-netgsm-plugin-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32545
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Canva Canva – Design beautiful blog graphics allows Reflected XSS.This issue affects Canva – Design beautiful blog graphics: from n/a through 1.2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/canva/wordpress-canva-design-beautiful-blog-graphics-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/canva/wordpress-canva-design-beautiful-blog-graphics-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32546
Published: 2024-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tax-rate-upload/wordpress-tax-rate-upload-plugin-2-4-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/tax-rate-upload/wordpress-tax-rate-upload-plugin-2-4-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-44227
Published: 2024-04-17
Description: Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/simple-file-list/wordpress-simple-file-list-plugin-6-1-8-arbitrary-file-deletion?_s_id=cve; https://patchstack.com/database/vulnerability/simple-file-list/wordpress-simple-file-list-plugin-6-1-8-arbitrary-file-deletion?_s_id=cve
CVE: CVE-2023-52642
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

media: rc: bpf attach/detach requires write permission

Note that bpf attach/detach also requires CAP_NET_ADMIN.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://git.kernel.org/stable/c/6a9d552483d50953320b9d3b57abdee8d436f23f; https://git.kernel.org/stable/c/93136132d1b5792bf44151e3494ae3691cd738e8; https://git.kernel.org/stable/c/93d8109bf182510629bbefc8cd45296d2393987f
CVE: CVE-2023-52643
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: core: fix memleak in iio_device_register_sysfs

When iio_device_register_sysfs_group() fails, we should
free iio_dev_opaque->chan_attr_group.attrs to prevent
potential memleak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363; https://git.kernel.org/stable/c/359f220d0e753bba840eac19ffedcdc816b532f2; https://git.kernel.org/stable/c/3db312e06851996e7fb27cb5a8ccab4c0f9cdb93
CVE: CVE-2024-1350
Published: 2024-04-17
Description: Missing Authorization vulnerability in Prasidhda Malla Honeypot for WP Comment.This issue affects Honeypot for WP Comment: from n/a through 2.2.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/honeypot-for-wp-comment/wordpress-honeypot-for-wp-comment-plugin-2-2-3-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/honeypot-for-wp-comment/wordpress-honeypot-for-wp-comment-plugin-2-2-3-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-26818
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

tools/rtla: Fix clang warning about mount_point var size

clang is reporting this warning:

$ make HOSTCC=clang CC=clang LLVM_IAS=1
[...]
clang -O -g -DVERSION=\"6.8.0-rc3\" -flto=auto -fexceptions
	-fstack-protector-strong -fasynchronous-unwind-tables
	-fstack-clash-protection  -Wall -Werror=format-security
	-Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS
	$(pkg-config --cflags libtracefs)    -c -o src/utils.o src/utils.c

src/utils.c:548:66: warning: 'fscanf' may overflow; destination buffer in argument 3 has size 1024, but the corresponding specifier may require size 1025 [-Wfortify-source]
  548 |         while (fscanf(fp, "%*s %" STR(MAX_PATH) "s %99s %*s %*d %*d\n", mount_point, type) == 2) {
      |                                                                         ^

Increase mount_point variable size to MAX_PATH+1 to avoid the overflow.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/30369084ac6e27479a347899e74f523e6ca29b89; https://git.kernel.org/stable/c/6bdd43f62ab3bb5a306af7f0ab857af45777f5a8; https://git.kernel.org/stable/c/8a585914c266dc044f53b5c83c170f79b45fcf9a
CVE: CVE-2024-26819
Published: 2024-04-17
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.