deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52477
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: hub: Guard against accesses to uninitialized BOS descriptors

Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h
access fields inside udev->bos without checking if it was allocated and
initialized. If usb_get_bos_descriptor() fails for whatever
reason, udev->bos will be NULL and those accesses will result in a
crash:

BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1>
Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021
Workqueue: usb_hub_wq hub_event
RIP: 0010:hub_port_reset+0x193/0x788
Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9
RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246
RAX: [PII_REDACTED] RBX: ffffa1bc5f678000 RCX: [PII_REDACTED]
RDX: fffffffffffffdff RSI: [PII_REDACTED] RDI: ffffa1be9655b840
RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: [PII_REDACTED]
R13: ffffab740c53fd3e R14: [PII_REDACTED] R15: [PII_REDACTED]
FS: [PII_REDACTED](0000) GS:ffffa1be96540000(0000) knlGS:[PII_REDACTED]
CS: 0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: [PII_REDACTED] CR3: 000000022e80c005 CR4:[PII_REDACTED]3706e0
Call Trace:
hub_event+0x73f/0x156e
? hub_activate+0x5b7/0x68f
process_one_work+0x1a2/0x487
worker_thread+0x11a/0x288
kthread+0x13a/0x152
? process_one_work+0x487/0x487
? kthread_associate_blkcg+0x70/0x70
ret_from_fork+0x1f/0x30

Fall back to a default behavior if the BOS descriptor isn't accessible
and skip all the functionalities that depend on it: LPM support checks,
Super Speed capabilitiy checks, U1/U2 states setup.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/136f69a04e71ba3458d137aec3bb2ce1232c0289; https://git.kernel.org/stable/c/241f230324337ed5eae3846a554fb6d15169872c; https://git.kernel.org/stable/c/528f0ba9f7a4bc1b61c9b6eb591ff97ca37cac6b
CVE: CVE-2023-52479
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix uaf in smb20_oplock_break_ack

drop reference after use opinfo.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/694e13732e830cbbfedb562e57f28644927c33fd; https://git.kernel.org/stable/c/8226ffc759ea59f10067b9acdf7f94bae1c69930; https://git.kernel.org/stable/c/c69813471a1ec081a0b9bf0c6bd7e8afd818afce
CVE: CVE-2023-52480
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix race condition between session lookup and expire

 Thread A                        +  Thread B
 ksmbd_session_lookup            |  smb2_sess_setup
   sess = xa_load                |
                                 |
                                 |    xa_erase(&conn->sessions, sess->id);
                                 |
                                 |    ksmbd_session_destroy(sess) --> kfree(sess)
                                 |
   // UAF!                       |
   sess->last_active = jiffies   |
                                 +

This patch add rwsem to fix race condition between ksmbd_session_lookup
and ksmbd_expire_session.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666be; https://git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745f; https://git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202b
CVE: CVE-2023-52481
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: errata: Add Cortex-A520 speculative unprivileged load workaround

Implement the workaround for ARM Cortex-A520 erratum 2966298. On an
affected Cortex-A520 core, a speculatively executed unprivileged load
might leak data from a privileged load via a cache side channel. The
issue only exists for loads within a translation regime with the same
translation (e.g. same ASID and VMID). Therefore, the issue only affects
the return to EL0.

The workaround is to execute a TLBI before returning to EL0 after all
loads of privileged data. A non-shareable TLBI to any address is
sufficient.

The workaround isn't necessary if page table isolation (KPTI) is
enabled, but for simplicity it will be. Page table isolation should
normally be disabled for Cortex-A520 as it supports the CSV3 feature
and the E0PD feature (used when KASLR is enabled).
CVSS Score: 4.7 (MEDIUM)
References: https://git.kernel.org/stable/c/32b0a4ffcaea44a00a61e40c0d1bcc50362aee25; https://git.kernel.org/stable/c/471470bc7052d28ce125901877dd10e4c048e513; https://git.kernel.org/stable/c/6e3ae2927b432a3b7c8374f14dbc1bd9ebe4372c
CVE: CVE-2023-52482
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/srso: Add SRSO mitigation for Hygon processors

Add mitigation for the speculative return stack overflow vulnerability
which exists on Hygon processors too.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/6ce2f297a[PII_REDACTED]d0b5aea6c7c16268b8a96; https://git.kernel.org/stable/c/a5ef7d68cea1344cf524f04981c2b3f80bedbb0d; https://git.kernel.org/stable/c/cf43b304b6952b549d58feabc342807b334f03d4
CVE: CVE-2023-52483
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

mctp: perform route lookups under a RCU read-side lock

Our current route lookups (mctp_route_lookup and mctp_route_lookup_null)
traverse the net's route list without the RCU read lock held. This means
the route lookup is subject to preemption, resulting in an potential
grace period expiry, and so an eventual kfree() while we still have the
route pointer.

Add the proper read-side critical section locks around the route
lookups, preventing premption and a possible parallel kfree.

The remaining net->mctp.routes accesses are already under a
rcu_read_lock, or protected by the RTNL for updates.

Based on an analysis from Sili Luo <rootlab@huawei.com>, where
introducing a delay in the route lookup could cause a UAF on
simultaneous sendmsg() and route deletion.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1db0724a01b558feb1ecae551782add1951a114a; https://git.kernel.org/stable/c/2405f64a95a7a094eb24cba9bcfaffd1ea264de4; https://git.kernel.org/stable/c/5093bbfc10ab6636b32728e35813cbd79feb063c
CVE: CVE-2023-52484
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range

When running an SVA case, the following soft lockup is triggered:
--------------------------------------------------------------------
watchdog: BUG: soft lockup - CPU#244 stuck for 26s!
pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50
lr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50
sp : ffff8000d83ef290
x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: [PII_REDACTED]
x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: [PII_REDACTED]
x23: [PII_REDACTED] x22: ffff8000d83ef340 x21: ffff0000c63980c0
x20: [PII_REDACTED] x19: ffff0000c6398080 x18: [PII_REDACTED]
x17: [PII_REDACTED] x16: [PII_REDACTED] x15: ffff3000b4a3bbb0
x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: [PII_REDACTED]
x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : ffffc08120e4d6bc
x8 : [PII_REDACTED] x7 : [PII_REDACTED] x6 :[PII_REDACTED]048cfa
x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 :[PII_REDACTED]00000a
x2 : [PII_REDACTED] x1 : [PII_REDACTED] x0 : [PII_REDACTED]
Call trace:
 arm_smmu_cmdq_issue_cmdlist+0x178/0xa50
 __arm_smmu_tlb_inv_range+0x118/0x254
 arm_smmu_tlb_inv_range_asid+0x6c/0x130
 arm_smmu_mm_invalidate_range+0xa0/0xa4
 __mmu_notifier_invalidate_range_end+0x88/0x120
 unmap_vmas+0x194/0x1e0
 unmap_region+0xb4/0x144
 do_mas_align_munmap+0x290/0x490
 do_mas_munmap+0xbc/0x124
 __vm_munmap+0xa8/0x19c
 __arm64_sys_munmap+0x28/0x50
 invoke_syscall+0x78/0x11c
 el0_svc_common.constprop.0+0x58/0x1c0
 do_el0_svc+0x34/0x60
 el0_svc+0x2c/0xd4
 el0t_64_sync_handler+0x114/0x140
 el0t_64_sync+0x1a4/0x1a8
--------------------------------------------------------------------

Note that since 6.6-rc1 the arm_smmu_mm_invalidate_range above is renamed
to "arm_smmu_mm_arch_invalidate_secondary_tlbs", yet the problem remains.

The commit 06ff87bae8d3 ("arm64: mm: remove unused functions and variable
protoypes") fixed a similar lockup on the CPU MMU side. Yet, it can occur
to SMMU too, since arm_smmu_mm_arch_invalidate_secondary_tlbs() is called
typically next to MMU tlb flush function, e.g.
	tlb_flush_mmu_tlbonly {
		tlb_flush {
			__flush_tlb_range {
				// check MAX_TLBI_OPS
			}
		}
		mmu_notifier_arch_invalidate_secondary_tlbs {
			arm_smmu_mm_arch_invalidate_secondary_tlbs {
				// does not check MAX_TLBI_OPS
			}
		}
	}

Clone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in an
SVA case SMMU uses the CPU page table, so it makes sense to align with the
tlbflush code. Then, replace per-page TLBI commands with a single per-asid
TLBI command, if the request size hits this threshold.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/3283a1bce9bbc978059f790b84f3c10c32492429; https://git.kernel.org/stable/c/d5afb4b47e13161b3f33904d45110f9e6463bad6; https://git.kernel.org/stable/c/f5a604757aa8e37ea9c7011dc9da54fa1b30f29b
CVE: CVE-2023-6090
Published: 2024-02-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Mollie Mollie Payments for WooCommerce.This issue affects Mollie Payments for WooCommerce: from n/a through 7.3.11.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/mollie-payments-for-woocommerce/wordpress-mollie-payments-for-woocommerce-plugin-7-3-11-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mollie-payments-for-woocommerce/wordpress-mollie-payments-for-woocommerce-plugin-7-3-11-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-1434
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Media Alt Renamer allows Stored XSS.This issue affects Media Alt Renamer: from n/a through 0.0.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/media-alt-renamer/wordpress-media-alt-renamer-plugin-0-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-alt-renamer/wordpress-media-alt-renamer-plugin-0-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-1437
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in José Fernandez Adsmonetizer allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/adsensei-b30/wordpress-adsmonetizer-plugin-3-1-2-reflected-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/adsensei-b30/wordpress-adsmonetizer-plugin-3-1-2-reflected-xss-vulnerability?_s_id=cve
CVE: CVE-2024-1976
Published: 2024-02-29
Description: The Marketing Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20200925. This is due to missing or incorrect nonce validation via the admin/main-settings-page.php file. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/marketing-optimizer/trunk/admin/main-settings-page.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b537637b-32c0-405e-94fa-c7c2d0c80658?source=cve; https://plugins.trac.wordpress.org/browser/marketing-optimizer/trunk/admin/main-settings-page.php
CVE: CVE-2024-1977
Published: 2024-02-29
Description: The Restaurant Solutions – Checklist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Checklist points in version 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2022-004; https://www.wordfence.com/threat-intel/vulnerabilities/id/8dca7f2e-f572-468a-8342-a6e096441561?source=cve; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2022-004
CVE: CVE-2024-21752
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ernest Marcinko Ajax Search Lite allows Reflected XSS.This issue affects Ajax Search Lite: from n/a through 4.11.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ajax-search-lite/wordpress-ajax-search-lite-plugin-4-11-4-reflected-xss-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ajax-search-lite/wordpress-ajax-search-lite-plugin-4-11-4-reflected-xss-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-23501
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shopfiles Ltd Ebook Store allows Stored XSS.This issue affects Ebook Store: from n/a through 5.788.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ebook-store/wordpress-ebook-store-plugin-5-788-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ebook-store/wordpress-ebook-store-plugin-5-788-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24525
Published: 2024-02-29
Description: An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-233
References: https://l3v3lforall.github.io/EpointWebBuilder_v5.x_VULN/; https://l3v3lforall.github.io/EpointWebBuilder_v5.x_VULN/
CVE: CVE-2024-25093
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Rating System allows Stored XSS.This issue affects GD Rating System: from n/a through 3.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gd-rating-system/wordpress-gd-rating-system-plugin-3-5-unauthenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gd-rating-system/wordpress-gd-rating-system-plugin-3-5-unauthenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-25094
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Jura & Nicolas Montigny PJ News Ticker allows Stored XSS.This issue affects PJ News Ticker: from n/a through 1.9.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pj-news-ticker/wordpress-pj-news-ticker-plugin-1-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pj-news-ticker/wordpress-pj-news-ticker-plugin-1-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-25098
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB oEmbed HTML5 Audio – with Cache Support allows Stored XSS.This issue affects PB oEmbed HTML5 Audio – with Cache Support: from n/a through 2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pb-oembed-html5-audio-with-cache-support/wordpress-pb-oembed-html5-audio-plugin-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pb-oembed-html5-audio-with-cache-support/wordpress-pb-oembed-html5-audio-plugin-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-1978
Published: 2024-02-29
Description: The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discover_available_feeds function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/akirk/friends/pull/290; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3036987%40friends&new=3036987%40friends&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/72e1fbce-86ae-4518-a613-7c322193acf4?source=cve
CVE: CVE-2024-1981
Published: 2024-02-29
Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9.68 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpvivid-backuprestore%2Ftrunk&old=2667839&new_path=%2Fwpvivid-backuprestore%2Ftrunk&new=2667839; https://research.hisolutions.com/2024/01/multiple-vulnerabilities-in-wordpress-plugin-wpvivid-backup-and-migration/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8bfb38-4f20-4f9f-bb30-a88f3be2d2d3?source=cve
CVE: CVE-2024-1982
Published: 2024-02-29
Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_restore_progress() and restore() functions in all versions up to, and including, 0.9.68. This makes it possible for unauthenticated attackers to exploit a SQL injection vulnerability or trigger a DoS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-89
References: https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpvivid-backuprestore%2Ftrunk&old=2667839&new_path=%2Fwpvivid-backuprestore%2Ftrunk&new=2667839; https://research.hisolutions.com/2024/01/multiple-vulnerabilities-in-wordpress-plugin-wpvivid-backup-and-migration/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4f17976e-d6b9-40fb-b2fb-d60bcfd68d12?source=cve
CVE: CVE-2024-25291
Published: 2024-02-29
Description: Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/ji-zzang/EQST-PoC/tree/main/2024/RCE/CVE-2024-25291; https://github.com/ji-zzang/EQST-PoC/tree/main/2024/RCE/CVE-2024-25291
CVE: CVE-2024-25292
Published: 2024-02-29
Description: Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/ji-zzang/EQST-PoC/tree/main/2024/RCE/CVE-2024-25292; https://github.com/ji-zzang/EQST-PoC/tree/main/2024/RCE/CVE-2024-25292
CVE: CVE-2024-25594
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Savvy Wordpress Development MyWaze allows Stored XSS.This issue affects MyWaze: from n/a through 1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/my-waze/wordpress-mywaze-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/my-waze/wordpress-mywaze-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-1887
Published: 2024-02-29
Description: Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-23488
Published: 2024-02-29
Description: Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.


CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-23493
Published: 2024-02-29
Description: Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-24988
Published: 2024-02-29
Description: Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-1888
Published: 2024-02-29
Description: Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-1619
Published: 2024-02-29
Description: Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrator to click on a malicious link to perform unauthorized actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://support.kaspersky.com/vulnerability/list-of-advisories/12430#010224; https://support.kaspersky.com/vulnerability/list-of-advisories/12430#010224
CVE: CVE-2024-1942
Published: 2024-02-29
Description: Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-1949
Published: 2024-02-29
Description: A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.


CVSS Score: 2.6 (LOW)
CWE: CWE-200, CWE-362
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates