deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3638
Published: 2024-07-04
Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Marquee Text Widget, Testimonials Widget, and Testimonial Slider widgets in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/templates/addons/marquee-text/content.php#L24; https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/templates/addons/marquee-text/content.php#L28; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3116758%40addons-for-elementor&new=3116758%40addons-for-elementor&sfp_email=&sfph_mail=
CVE: CVE-2024-3639
Published: 2024-07-04
Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's  Posts Grid widget in all versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping on user supplied attributes like 'grid_skin'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3114186%40addons-for-elementor&new=3114186%40addons-for-elementor&sfp_email=&sfph_mail=; https://wordpress.org/plugins/addons-for-elementor/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9729ccc9-e3f1-4096-8430-22998b386cec?source=cve
CVE: CVE-2024-5641
Published: 2024-07-04
Description: The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ced_ocor_save_general_setting' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the plugin settings, including adding stored cross-site scripting.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862, CWE-79
References: https://plugins.trac.wordpress.org/browser/one-click-order-reorder/trunk/includes/class-basket-order.php#L489; https://plugins.trac.wordpress.org/changeset/3110914/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8a297784-96cd-4135-a8f1-e50f3a0d71bd?source=cve
CVE: CVE-2024-1182
Published: 2024-07-04
Description: Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior allows a local attacker to execute a malicious code by storing a specially crafted DLL in a specific folder when GENESIS64, ICONICS Suite, Hyper Historian, GENESIS32, and MC Works64 are installed with the Pager agent in the alarm multi-agent notification feature.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://jvn.jp/vu/JVNVU98894016/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
CVE: CVE-2024-1573
Published: 2024-07-04
Description: Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric AnalytiX versions 10.97.2 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 and prior, Mitsubishi Electric IoTWorX version 10.95, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 and prior, and Mitsubishi Electric Iconics Digital Solutions IoTWorX version 10.95 allows a remote unauthenticated attacker to bypass proper authentication and log in to the system when all of the following conditions are met: (1) Active Directory is used in the security setting (2) "Automatic log in" option is enabled in the security setting (3) The IcoAnyGlass IIS Application Pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, and MC Works64 Security and has permission to log in.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-306
References: https://jvn.jp/vu/JVNVU98894016/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
CVE: CVE-2024-1574
Published: 2024-07-04
Description: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of Mitsubishi Electric GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric AnalytiX versions 10.97.2 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric BizViz versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric Iconics Digital Solutions BizViz versions 9.7 and prior allows a local attacker to execute a malicious code with administrative privileges by tampering with a specific file that is not protected by the system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-470
References: https://jvn.jp/vu/JVNVU98894016/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
CVE: CVE-2024-39884
Published: 2024-07-04
Description: A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.   "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Users are recommended to upgrade to version 2.4.61, which fixes this issue.
CVSS Score: 6.2 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/07/17/6; https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-3904
Published: 2024-07-04
Description: Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions "05" to "07" allows a local attacker to execute arbitrary code by saving a malicious file to a specific folder. As a result, the attacker may disclose, tamper with, destroy or delete information in the product, or cause a denial-of-service (DoS) condition on the product.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://jvn.jp/vu/JVNVU91215350/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-02; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-003_en.pdf
CVE: CVE-2024-6318
Published: 2024-07-04
Description: The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.class.php#L122; https://plugins.trac.wordpress.org/changeset/3107741/imgspider; https://www.wordfence.com/threat-intel/vulnerabilities/id/306f00e4-9a70-48be-a91e-e396643a8129?source=cve
CVE: CVE-2024-6319
Published: 2024-07-04
Description: The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.class.php#L189; https://plugins.trac.wordpress.org/changeset/3107741/imgspider; https://www.wordfence.com/threat-intel/vulnerabilities/id/63a4a077-c99e-4742-9fa1-f323fd24b950?source=cve
CVE: CVE-2024-6434
Published: 2024-07-04
Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible for authenticated attackers, with Author-level access and above, to create and query a malicious post title, resulting in slowing server resources.
CVSS Score: 3.1 (LOW)
CWE: CWE-400, CWE-1333
References: https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/class-premium-template-tags.php#L1676; https://plugins.trac.wordpress.org/changeset/3110991/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3c59d95a-b7f1-4a04-bbf4-bab2c42d6d75?source=cve
CVE: CVE-2024-32754
Published: 2024-07-04
Description: Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version.  Once configured, the controller will no longer broadcast this information.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-01; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-01
CVE: CVE-2024-5943
Published: 2024-07-04
Description: The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorrect nonce validation on the 'settingsPage' function and missing santization of the 'tab' parameter. This makes it possible for unauthenticated attackers to call local php files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/wp-nested-pages/trunk/app/Config/Settings.php#L129; https://plugins.trac.wordpress.org/browser/wp-nested-pages/trunk/app/Views/settings/settings.php#L20; https://plugins.trac.wordpress.org/changeset/3111847/
CVE: CVE-2024-6507
Published: 2024-07-04
Description: Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API
CVSS Score: 8.1 (HIGH)
CWE: CWE-78, CWE-94
References: https://github.com/activeloopai/deeplake/pull/2876; https://research.jfrog.com/vulnerabilities/deeplake-kaggle-command-injection-jfsa-2[PII_REDACTED]20/; https://github.com/activeloopai/deeplake/pull/2876
CVE: CVE-2024-39165
Published: 2024-07-04
Description: QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload in the data parameter in conjunction with a .php file name in the filename parameter. This occurs because an unnecessary QR/demoapp folder.is shipped with the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://synacktiv.com/en/advisories/jpgraph-professional-version-pre-authenticated-remote-code-execution; https://www.synacktiv.com/advisories/jpgraph-professional-version-pre-authenticated-remote-code-execution
CVE: CVE-2024-39211
Published: 2024-07-04
Description: Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the user account exists.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://github.com/artemy-ccrsky/CVE-2024-39211; https://github.com/artemy-ccrsky/CVE-2024-39211/blob/main/CVE-2024-39211.sh; https://kaiten.ru
CVE: CVE-2024-6506
Published: 2024-07-04
Description: Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also allows an attacker to create or overwrite shipping labels.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug; https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug
CVE: CVE-2024-22277
Published: 2024-07-04
Description: VMware Cloud Director Availability contains an HTML injection vulnerability. 
A
 malicious actor with network access to VMware Cloud Director 
Availability can craft malicious HTML tags to execute within replication
 tasks.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557
CVE: CVE-2024-39929
Published: 2024-07-04
Description: Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-116
References: https://bugs.exim.org/show_bug.cgi?id=3099#c4; https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b; https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357
CVE: CVE-2024-39930
Published: 2024-07-04
Description: The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-88
References: https://github.com/gogs/gogs/releases; https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/; https://www.vicarius.io/vsociety/posts/argument-injection-in-gogs-ssh-server-cve-2024-39930
CVE: CVE-2024-39931
Published: 2024-07-04
Description: Gogs through 0.13.0 allows deletion of internal files.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-552
References: https://github.com/gogs/gogs/releases; https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/; https://github.com/gogs/gogs/releases
CVE: CVE-2024-39932
Published: 2024-07-04
Description: Gogs through 0.13.0 allows argument injection during the previewing of changes.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://github.com/gogs/gogs/releases; https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/; https://github.com/gogs/gogs/releases
CVE: CVE-2024-39933
Published: 2024-07-04
Description: Gogs through 0.13.0 allows argument injection during the tagging of a new release.
CVSS Score: 7.7 (HIGH)
CWE: CWE-88
References: https://github.com/gogs/gogs/releases; https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/; https://github.com/gogs/gogs/releases
CVE: CVE-2024-6513
Published: 2024-07-04
Description: Rejected reason: CVE assigned by mistake as a duplicate.
CVE: CVE-2024-37476
Published: 2024-07-04
Description: Cross Site Scripting (XSS) vulnerability in Automattic Newspack Campaigns allows Stored XSS.This issue affects Newspack Campaigns: from n/a through 2.31.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/newspack-popups/wordpress-newspack-campaigns-plugin-2-31-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/newspack-popups/wordpress-newspack-campaigns-plugin-2-31-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37471
Published: 2024-07-04
Description: Cross Site Scripting (XSS) vulnerability in WofficeIO Woffice Core allows Reflected XSS.This issue affects Woffice Core: from n/a through 5.4.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/woffice-core/wordpress-woffice-core-plugin-5-4-8-site-wide-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woffice-core/wordpress-woffice-core-plugin-5-4-8-site-wide-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37472
Published: 2024-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Theme/woffice/vulnerability/wordpress-woffice-theme-5-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woffice/wordpress-woffice-theme-5-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37474
Published: 2024-07-04
Description: Cross Site Scripting (XSS) vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/newspack-ads/wordpress-newspack-ads-plugin-1-47-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/newspack-ads/wordpress-newspack-ads-plugin-1-47-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-39934
Published: 2024-07-04
Description: Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotree usage" feature allows any user to edit any Python environment.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://checkmk.com/werk/16434; https://github.com/elabit/robotmk/commit/78c1174ab2df43813050d0c22e1efb8636f8715e; https://github.com/elabit/robotmk/compare/v2.0.0...v2.0.1
CVE: CVE-2024-6511
Published: 2024-07-04
Description: A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270343.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/y_project/RuoYi/issues/IA8O7O; https://vuldb.com/?ctiid.270343; https://vuldb.com/?id.270343
CVE: CVE-2024-39935
Published: 2024-07-04
Description: jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privileges) via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/NginxProxyManager/nginx-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc46; https://github.com/NginxProxyManager/nginx-proxy-manager/compare/v2.11.2...v2.11.3; https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3662
CVE: CVE-2024-39936
Published: 2024-07-04
Description: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..
CVSS Score: 8.6 (HIGH)
CWE: CWE-367, CWE-367
References: https://codereview.qt-project.org/c/qt/qtbase/+/571601; https://codereview.qt-project.org/c/qt/qtbase/+/571601; https://lists.debian.org/debian-lts-announce/2025/11/msg00031.html
CVE: CVE-2024-39937
Published: 2024-07-04
Description: supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22, CWE-22
References: https://cloud.supos.com/announcement/detail?id=[PII_REDACTED]17671680; https://github.com/bytehunter-rat/supOS-BUG/blob/main/supOSDirectoryTraversal.md; https://www.supos.com/supOSindex
CVE: CVE-2024-39943
Published: 2024-07-04
Description: rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78, CWE-284
References: https://github.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad1d; https://github.com/rejetto/hfs/compare/v0.52.9...v0.52.10; https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads
CVE: CVE-2023-52340
Published: 2024-07-05
Description: The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c37799f0d5576ccef277; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3