deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5587
Published: 2024-06-02
Description: A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the component Configuration File Handler. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266838 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://vuldb.com/?ctiid.266838; https://vuldb.com/?id.266838; https://vuldb.com/?submit.343357
CVE: CVE-2024-2178
Published: 2024-06-02
Description: A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_infos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'category' and 'name' parameters during the 'Copy to custom personas folder for editing' process. By inserting '../' sequences in these parameters, attackers can traverse the directory structure and access files outside of the intended directory. Successful exploitation results in unauthorized access to sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-29
References: https://huntr.com/bounties/e585f1dd-a026-4419-8f42-5835e85fad9e; https://huntr.com/bounties/e585f1dd-a026-4419-8f42-5835e85fad9e
CVE: CVE-2024-27776
Published: 2024-06-02
Description: MileSight DeviceHub - 

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-36388
Published: 2024-06-02
Description: MileSight DeviceHub - 



CWE-305 Missing Authentication for Critical Function
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-305, CWE-306
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-36389
Published: 2024-06-02
Description: MileSight DeviceHub - 





CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-36390
Published: 2024-06-02
Description: MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-36391
Published: 2024-06-02
Description: MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-320
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-36392
Published: 2024-06-02
Description: MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-5588
Published: 2024-06-02
Description: A vulnerability was found in itsourcecode Learning Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file processscore.php. The manipulation of the argument LessonID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266839.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/12; https://vuldb.com/?ctiid.266839; https://vuldb.com/?id.266839
CVE: CVE-2024-5589
Published: 2024-06-03
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /admin/config_MT.php?action=delete. The manipulation of the argument Mid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266847. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-config_MT.md; https://vuldb.com/?ctiid.266847; https://vuldb.com/?id.266847
CVE: CVE-2024-5590
Published: 2024-06-03
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. This vulnerability affects unknown code of the file /protocol/iscuser/uploadiscuser.php of the component JSON Content Handler. The manipulation of the argument messagecontent leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266848. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-uploadiscuser.md; https://vuldb.com/?ctiid.266848; https://vuldb.com/?id.266848
CVE: CVE-2024-20065
Published: 2024-06-03
Description: In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08698617; Issue ID: MSV-1394.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20066
Published: 2024-06-03
Description: In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is no needed for exploitation. Patch ID: MOLY01267281; Issue ID: MSV-1477.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20067
Published: 2024-06-03
Description: In modem, there is a possible out of bounds write due to improper input invalidation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01267285; Issue ID: MSV-1462.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20068
Published: 2024-06-03
Description: In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is no needed for exploitation. Patch ID: MOLY01270721; Issue ID: MSV-1479.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20069
Published: 2024-06-03
Description: In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01286330; Issue ID: MSV-1430.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-757
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20070
Published: 2024-06-03
Description: In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to remote information disclosure, when weak encryption algorithm is used, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00942482; Issue ID: MSV-1469.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20071
Published: 2024-06-03
Description: In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00364733; Issue ID: MSV-1331.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20072
Published: 2024-06-03
Description: In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00364732; Issue ID: MSV-1332.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20073
Published: 2024-06-03
Description: In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00367704; Issue ID: MSV-1411.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20074
Published: 2024-06-03
Description: In dmc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08668110; Issue ID: MSV-1333.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2024-20075
Published: 2024-06-03
Description: In eemgpu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08713302; Issue ID: MSV-1393.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2024; https://corp.mediatek.com/product-security-bulletin/June-2024
CVE: CVE-2023-42427
Published: 2024-06-03
Description: Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN43215077/; https://www.jast-gakuen.com/products/unipa/; https://jvn.jp/en/jp/JVN43215077/
CVE: CVE-2023-51436
Published: 2024-06-03
Description: Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker with an administrative privilege to execute an arbitrary script on the web browser of the user who is using the product. 
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN43215077/; https://www.jast-gakuen.com/products/unipa/; https://jvn.jp/en/jp/JVN43215077/
CVE: CVE-2024-36042
Published: 2024-06-03
Description: Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://gist.github.com/ChrisPritchard/4b6d5c70d9329ef116266a6c238dcb2d; https://github.com/Silverpeas/Silverpeas-Core/tags; https://silverpeas.org/
CVE: CVE-2024-37031
Published: 2024-06-03
Description: The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2; https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm; https://rubygems.org/gems/activeadmin/versions/3.2.2
CVE: CVE-2024-35641
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GregRoss Just Writing Statistics allows Stored XSS.This issue affects Just Writing Statistics: from n/a through 4.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/just-writing-statistics/wordpress-just-writing-statistics-plugin-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/just-writing-statistics/wordpress-just-writing-statistics-plugin-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35642
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bryan Hadaway Site Favicon allows Stored XSS.This issue affects Site Favicon: from n/a through 0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/site-favicon/wordpress-site-favicon-plugin-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/site-favicon/wordpress-site-favicon-plugin-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35643
Published: 2024-06-03
Description: Cross Site Scripting (XSS) vulnerability in Xabier Miranda WP Back Button allows Stored XSS.This issue affects WP Back Button: from n/a through 1.1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-back-button/wordpress-wp-back-button-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-back-button/wordpress-wp-back-button-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-5311
Published: 2024-06-03
Description: DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database records.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7844-52dad-1.html; https://www.twcert.org.tw/tw/cp-132-7844-52dad-1.html
CVE: CVE-2023-48789
Published: 2024-06-03
Description: A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-602
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-406; https://fortiguard.fortinet.com/psirt/FG-IR-23-406
CVE: CVE-2024-23107
Published: 2024-06-03
Description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-191; https://fortiguard.fortinet.com/psirt/FG-IR-23-191
CVE: CVE-2024-31493
Published: 2024-06-03
Description: An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-212
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-052; https://fortiguard.fortinet.com/psirt/FG-IR-24-052
CVE: CVE-2024-35640
Published: 2024-06-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit allows Stored XSS.This issue affects Safety Exit: from n/a through 1.7.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/safety-exit/wordpress-safety-exit-plugin-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/safety-exit/wordpress-safety-exit-plugin-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-36960
Published: 2024-06-03
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Fix invalid reads in fence signaled events

Correctly set the length of the drm_event to the size of the structure
that's actually used.

The length of the drm_event was set to the parent structure instead of
to the drm_vmw_event_fence which is supposed to be read. drm_read
uses the length parameter to copy the event to the user space thus
resuling in oob reads.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/0dbfc73670b[PII_REDACTED]30551e586345ca48e1b; https://git.kernel.org/stable/c/2f527e3efd37c7c5e85e8aa86308856b619fa59f; https://git.kernel.org/stable/c/3cd682357c6167f636aec8ac0efaa8ba61144d36
CVE: CVE-2024-36961
Published: 2024-06-03
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal/debugfs: Fix two locking issues with thermal zone debug

With the current thermal zone locking arrangement in the debugfs code,
user space can open the "mitigations" file for a thermal zone before
the zone's debugfs pointer is set which will result in a NULL pointer
dereference in tze_seq_start().

Moreover, thermal_debug_tz_remove() is not called under the thermal
zone lock, so it can run in parallel with the other functions accessing
the thermal zone's struct thermal_debugfs object.  Then, it may clear
tz->debugfs after one of those functions has checked it and the
struct thermal_debugfs object may be freed prematurely.

To address the first problem, pass a pointer to the thermal zone's
struct thermal_debugfs object to debugfs_create_file() in
thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(),
tze_seq_stop(), and tze_seq_show() retrieve it from s->private
instead of a pointer to the thermal zone object.  This will ensure
that tz_debugfs will be valid across the "mitigations" file accesses
until thermal_debugfs_remove_id() called by thermal_debug_tz_remove()
removes that file.

To address the second problem, use tz->lock in thermal_debug_tz_remove()
around the tz->debugfs value check (in case the same thermal zone is
removed at the same time in two different threads) and its reset to NULL.

Cc :6.8+ <stable@vger.kernel.org> # 6.8+
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/6c57bdd0505422d5ccd2df541d993aec978c842e; https://git.kernel.org/stable/c/c7f7c37271787a7f77d7eedc132b0b419a76b4c8; https://git.kernel.org/stable/c/6c57bdd0505422d5ccd2df541d993aec978c842e
CVE: CVE-2024-36962
Published: 2024-06-03
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs

Currently the driver uses local_bh_disable()/local_bh_enable() in its
IRQ handler to avoid triggering net_rx_action() softirq on exit from
netif_rx(). The net_rx_action() could trigger this driver .start_xmit
callback, which is protected by the same lock as the IRQ handler, so
calling the .start_xmit from netif_rx() from the IRQ handler critical
section protected by the lock could lead to an attempt to claim the
already claimed lock, and a hang.

The local_bh_disable()/local_bh_enable() approach works only in case
the IRQ handler is protected by a spinlock, but does not work if the
IRQ handler is protected by mutex, i.e. this works for KS8851 with
Parallel bus interface, but not for KS8851 with SPI bus interface.

Remove the BH manipulation and instead of calling netif_rx() inside
the IRQ handler code protected by the lock, queue all the received
SKBs in the IRQ handler into a queue first, and once the IRQ handler
exits the critical section protected by the lock, dequeue all the
queued SKBs and push them all into netif_rx(). At this point, it is
safe to trigger the net_rx_action() softirq, since the netif_rx()
call is outside of the lock that protects the IRQ handler.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/7e2901a2a9195da76111f351584bf77552a038f0; https://git.kernel.org/stable/c/8a3ff43dcbab7c96f9e8cf2bd1049ab8d6e59545; https://git.kernel.org/stable/c/ae87f661f3c1a3134a7ed86ab69bf9f12af88993
CVE: CVE-2024-36963
Published: 2024-06-03
Description: In the Linux kernel, the following vulnerability has been resolved:

tracefs: Reset permissions on remount if permissions are options

There's an inconsistency with the way permissions are handled in tracefs.
Because the permissions are generated when accessed, they default to the
root inode's permission if they were never set by the user. If the user
sets the permissions, then a flag is set and the permissions are saved via
the inode (for tracefs files) or an internal attribute field (for
eventfs).

But if a remount happens that specify the permissions, all the files that
were not changed by the user gets updated, but the ones that were are not.
If the user were to remount the file system with a given permission, then
all files and directories within that file system should be updated.

This can cause security issues if a file's permission was updated but the
admin forgot about it. They could incorrectly think that remounting with
permissions set would update all files, but miss some.

For example:

 # cd /sys/kernel/tracing
 # chgrp 1002 current_tracer
 # ls -l
[..]
 -rw-r-----  1 root root 0 May  1 21:25 buffer_size_kb
 -rw-r-----  1 root root 0 May  1 21:25 buffer_subbuf_size_kb
 -r--r-----  1 root root 0 May  1 21:25 buffer_total_size_kb
 -rw-r-----  1 root lkp  0 May  1 21:25 current_tracer
 -rw-r-----  1 root root 0 May  1 21:25 dynamic_events
 -r--r-----  1 root root 0 May  1 21:25 dyn_ftrace_total_info
 -r--r-----  1 root root 0 May  1 21:25 enabled_functions

Where current_tracer now has group "lkp".

 # mount -o remount,gid=1001 .
 # ls -l
 -rw-r-----  1 root tracing 0 May  1 21:25 buffer_size_kb
 -rw-r-----  1 root tracing 0 May  1 21:25 buffer_subbuf_size_kb
 -r--r-----  1 root tracing 0 May  1 21:25 buffer_total_size_kb
 -rw-r-----  1 root lkp     0 May  1 21:25 current_tracer
 -rw-r-----  1 root tracing 0 May  1 21:25 dynamic_events
 -r--r-----  1 root tracing 0 May  1 21:25 dyn_ftrace_total_info
 -r--r-----  1 root tracing 0 May  1 21:25 enabled_functions

Everything changed but the "current_tracer".

Add a new link list that keeps track of all the tracefs_inodes which has
the permission flags that tell if the file/dir should use the root inode's
permission or not. Then on remount, clear all the flags so that the
default behavior of using the root inode's permission is done for all
files and directories.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://git.kernel.org/stable/c/414fb[PII_REDACTED]3d29ccd0264b5a83fb9523c03; https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78; https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54