deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1036
Published: 2024-01-30
Description: A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon of the file /application/index/controller/Screen.php of the component Icon Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252311.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://note.zhaoj.in/share/X1ASzPP5rHel; https://vuldb.com/?ctiid.252311; https://vuldb.com/?id.252311
CVE: CVE-2024-21388
Published: 2024-01-30
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21388; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21388
CVE: CVE-2024-23841
Published: 2024-01-30
Description: apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.
CVSS Score: 8.2 (HIGH)
CWE: CWE-80
References: https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b; https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg; https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b
CVE: CVE-2024-24556
Published: 2024-01-30
Description: urql is a GraphQL client that exposes a set of helpers for several frameworks.  The `@urql/next` package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns `html` tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream. To fix this vulnerability upgrade to version 1.1.1
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://github.com/urql-graphql/urql/commit/4b7011b70d5718728ff912d02a4dbdc7f703540d; https://github.com/urql-graphql/urql/security/advisories/GHSA-qhjf-hm5j-335w; https://github.com/urql-graphql/urql/commit/4b7011b70d5718728ff912d02a4dbdc7f703540d
CVE: CVE-2023-5389
Published: 2024-01-30
Description: 
An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. 
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-749
References: https://process.honeywell.com; https://www.honeywell.com/us/en/product-security; https://process.honeywell.com
CVE: CVE-2024-24558
Published: 2024-01-30
Description: TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web.  The `@tanstack/react-query-next-experimental` NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later.

CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/TanStack/query/commit/f2ddaf2536e8b71d2da88a9310ac9a48c13512a1; https://github.com/TanStack/query/security/advisories/GHSA-997g-27x8-43rf; https://github.com/TanStack/query/commit/f2ddaf2536e8b71d2da88a9310ac9a48c13512a1
CVE: CVE-2024-24567
Published: 2024-01-30
Description: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-754
References: https://github.com/vyperlang/vyper/blob/[PII_REDACTED]f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100; https://github.com/vyperlang/vyper/security/advisories/GHSA-x2c2-q32w-4w6m; https://github.com/vyperlang/vyper/blob/[PII_REDACTED]f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100
CVE: CVE-2023-51197
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-51198
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-51202
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-51204
Published: 2024-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-1059
Published: 2024-01-30
Description: Use after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html; https://crbug.com/1514777; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUXJY3YC3VGIJW2AOHL4NZ7ZK7BRYWY/
CVE: CVE-2024-1060
Published: 2024-01-30
Description: Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html; https://crbug.com/1511567; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUXJY3YC3VGIJW2AOHL4NZ7ZK7BRYWY/
CVE: CVE-2024-1077
Published: 2024-01-30
Description: Use after free in Network in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html; https://crbug.com/1511085; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUXJY3YC3VGIJW2AOHL4NZ7ZK7BRYWY/
CVE: CVE-2024-23834
Published: 2024-01-30
Description: Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta5.  As a workaround, ensure Content Security Policy is enabled and does not include `unsafe-inline`.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000; https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pc; https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094
CVE: CVE-2024-22569
Published: 2024-01-31
Description: Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=index&step=2&is_install_db=0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Num-Nine/CVE/issues/12; https://github.com/Num-Nine/CVE/issues/12
CVE: CVE-2024-23745
Published: 2024-01-31
Description: In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://blog.xpnsec.com/dirtynib/; https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model; https://github.com/louiselalanne/CVE-2024-23745
CVE: CVE-2023-2439
Published: 2024-01-31
Description: The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681; https://www.wordfence.com/threat-intel/vulnerabilities/id/21cb424c-4efd-4c12-a08a-6d574f118c28?source=cve; https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE: CVE-2023-31505
Published: 2024-01-31
Description: An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://m3n0sd0n4ld.github.io/patoHackventuras/cve-2023-31505; https://m3n0sd0n4ld.github.io/patoHackventuras/cve-2023-31505
CVE: CVE-2024-1069
Published: 2024-01-31
Description: The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/includes/plugin-pages.php?rev=3003884#L1213; https://plugins.trac.wordpress.org/changeset/3028640/contact-form-entries#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/120313be-9f98-4448-9f5d-a77186a6ff08?source=cve
CVE: CVE-2024-0914
Published: 2024-01-31
Description: A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://access.redhat.com/errata/RHSA-2024:1239; https://access.redhat.com/errata/RHSA-2024:1411; https://access.redhat.com/errata/RHSA-2024:1608
CVE: CVE-2023-3934
Published: 2024-01-31
Description: Rejected reason: Please discard this CVE, we are not using this anymore. The vulnerability turned out to be a non-security issue
CVE: CVE-2024-22236
Published: 2024-01-31
Description: In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.






CVSS Score: 3.3 (LOW)
CWE: CWE-732, CWE-377
References: https://spring.io/security/cve-2024-22236; https://spring.io/security/cve-2024-22236
CVE: CVE-2024-0836
Published: 2024-01-31
Description: The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3028627/review-schema/trunk/app/Controllers/Ajax/Review.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b7039206-a25a-4aa0-87e2-be11dd1f12eb?source=cve; https://plugins.trac.wordpress.org/changeset/3028627/review-schema/trunk/app/Controllers/Ajax/Review.php
CVE: CVE-2024-1012
Published: 2024-01-31
Description: A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0. This issue affects some unknown processing of the file defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp. The manipulation of the argument recordId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252281 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/4nNns/cveAdd/blob/b73e94ff089ae2201d9836b4d61b8175ff21618a/sqli/%E4%B8%87%E6%88%B7EZOFFICE%20%E5%89%8D%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md; https://vuldb.com/?ctiid.252281; https://vuldb.com/?id.252281
CVE: CVE-2024-23170
Published: 2024-01-31
Description: An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203, CWE-385
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/
CVE: CVE-2024-23775
Published: 2024-01-31
Description: Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/; https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/
CVE: CVE-2023-44312
Published: 2024-01-31
Description: Exposure of Sensitive Information to an Unauthorized Actor in Apache ServiceComb Service-Center.This issue affects 

Apache ServiceComb Service-Center

 before 2.1.0 (include).

Users are recommended to upgrade to version 2.2.0, which fixes the issue.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2024/01/31/5; https://lists.apache.org/thread/dkvlgnrmc17qzjdy9k0cr60wpzcssk1s; http://www.openwall.com/lists/oss-security/2024/01/31/5
CVE: CVE-2023-44313
Published: 2024-01-31
Description: Server-Side Request Forgery (SSRF) vulnerability in Apache ServiceComb Service-Center. Attackers can obtain sensitive server information through specially crafted requests.This issue affects Apache ServiceComb before 2.1.0(include).

Users are recommended to upgrade to version 2.2.0, which fixes the issue.
CVSS Score: 7.6 (HIGH)
CWE: CWE-918
References: http://www.openwall.com/lists/oss-security/2024/01/31/4; https://lists.apache.org/thread/kxovd455o9h4f2v811hcov2qknbwld5r; http://www.openwall.com/lists/oss-security/2024/01/31/4
CVE: CVE-2023-50356
Published: 2024-01-31
Description: SSL connections to some LDAP servers are vulnerable to a man-in-the-middle attack due to improper certificate validation in AREAL Topkapi Vision (Server). This allows a remote unauthenticated attacker to gather sensitive information and prevent valid users from login.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://www.areal-topkapi.com/en/services/security-bulletins; https://www.areal-topkapi.com/en/services/security-bulletins
CVE: CVE-2023-50357
Published: 2024-01-31
Description: A cross site scripting vulnerability in the AREAL SAS Websrv1 ASP website allows a remote low-privileged attacker to gain escalated privileges of other non-admin users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.areal-topkapi.com/en/services/security-bulletins; https://www.areal-topkapi.com/en/services/security-bulletins
CVE: CVE-2024-1098
Published: 2024-01-31
Description: A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to information disclosure. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252455.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://vuldb.com/?ctiid.252455; https://vuldb.com/?id.252455; https://www.yuque.com/mailemonyeyongjuan/tha8tr/ouiw375l0m8mw5ls
CVE: CVE-2024-1099
Published: 2024-01-31
Description: A vulnerability was found in Rebuild up to 3.5.5. It has been classified as problematic. Affected is the function getFileOfData of the file /filex/read-raw. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252456.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.252456; https://vuldb.com/?id.252456; https://www.yuque.com/mailemonyeyongjuan/tha8tr/dcilugg0htp973nx
CVE: CVE-2024-22287
Published: 2024-01-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links: from n/a through 1.7.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/better-anchor-links/wordpress-better-anchor-links-plugin-1-7-5-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/better-anchor-links/wordpress-better-anchor-links-plugin-1-7-5-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-22290
Published: 2024-01-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom Dashboard Widgets: from n/a through 1.3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/custom-dashboard-widgets/wordpress-custom-dashboard-widgets-plugin-1-3-1-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-dashboard-widgets/wordpress-custom-dashboard-widgets-plugin-1-3-1-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-22305
Published: 2024-01-31
Description: Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/kali-forms/wordpress-kali-forms-plugin-2-3-38-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kali-forms/wordpress-kali-forms-plugin-2-3-38-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-23507
Published: 2024-01-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-0-9-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-7043
Published: 2024-01-31
Description: Unquoted service path in ESET products allows to 

drop a prepared program to a specific location and run on boot with the 

NT AUTHORITY\NetworkService permissions.
CVSS Score: 3.3 (LOW)
CWE: CWE-428, CWE-428
References: https://support.eset.com/en/ca8602; https://support.eset.com/en/ca8602
CVE: CVE-2024-0589
Published: 2024-01-31
Description: Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows allows an attacker with access to a data source to inject a malicious script via a specially crafted input in an entry.






CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://devolutions.net/security/advisories/DEVO-2024-0001/; https://devolutions.net/security/advisories/DEVO-2024-0001/
CVE: CVE-2024-1085
Published: 2024-01-31
Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability.

We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.


CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7; https://kernel.dance/b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7