deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48651
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header

If an AF_PACKET socket is used to send packets through ipvlan and the
default xmit function of the AF_PACKET socket is changed from
dev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option
name of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset and
remains as the initial value of 65535, this may trigger slab-out-of-bounds
bugs as following:

=================================================================
UG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]
PU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6
ardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33
all Trace:
print_address_description.constprop.0+0x1d/0x160
print_report.cold+0x4f/0x112
kasan_report+0xa3/0x130
ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]
ipvlan_start_xmit+0x29/0xa0 [ipvlan]
__dev_direct_xmit+0x2e2/0x380
packet_direct_xmit+0x22/0x60
packet_snd+0x7c9/0xc40
sock_sendmsg+0x9a/0xa0
__sys_sendto+0x18a/0x230
__x64_sys_sendto+0x74/0x90
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd

The root cause is:
  1. packet_snd() only reset skb->mac_header when sock->type is SOCK_RAW
     and skb->protocol is not specified as in packet_parse_headers()

  2. packet_direct_xmit() doesn't reset skb->mac_header as dev_queue_xmit()

In this case, skb->mac_header is 65535 when ipvlan_xmit_mode_l2() is
called. So when ipvlan_xmit_mode_l2() gets mac header with eth_hdr() which
use "skb->head + skb->mac_header", out-of-bound access occurs.

This patch replaces eth_hdr() with skb_eth_hdr() in ipvlan_xmit_mode_l2()
and reset mac header in multicast to solve this out-of-bound bug.
CVSS Score: 7.7 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/25efdbe5fe542c3063d1948cc4e98abcb57621ca; https://git.kernel.org/stable/c/346e94aa4a99378592c46d6a34c72703a32bd5be; https://git.kernel.org/stable/c/81225b2ea161af48e093f58e8dfee6d705b16af4
CVE: CVE-2022-48654
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()

nf_osf_find() incorrectly returns true on mismatch, this leads to
copying uninitialized memory area in nft_osf which can be used to leak
stale kernel stack data to userspace.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/559c36c5a8d730c49ef805a72b213d3bba155cc8; https://git.kernel.org/stable/c/5d75fef3e61e797fab5c3fbba88caa74ab92ad47; https://git.kernel.org/stable/c/633c81c0449663f57d4138326d036dc6cfad674e
CVE: CVE-2022-48655
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Harden accesses to the reset domains

Accessing reset domains descriptors by the index upon the SCMI drivers
requests through the SCMI reset operations interface can potentially
lead to out-of-bound violations if the SCMI driver misbehave.

Add an internal consistency check before any such domains descriptors
accesses.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-125
References: https://git.kernel.org/stable/c/1f08a1b26cfc53b7715abc46857c6023bb1b87de; https://git.kernel.org/stable/c/7184491fc515f391afba23d0e9b690caaea72daf; https://git.kernel.org/stable/c/8e65edf0d37698f7a6cb174608d3ec7976baf49e
CVE: CVE-2022-48656
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get()

We should call of_node_put() for the reference returned by
of_parse_phandle() in fail path or when it is not used anymore.
Here we only need to move the of_node_put() before the check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/a17df55bf6d536712da6902a83db82b82e67d5a2; https://git.kernel.org/stable/c/aa11dae059a439af82bae541b134f8f53ac177b5; https://git.kernel.org/stable/c/dd5a6c5a08752b613e83ad2cb5133e72a64b876d
CVE: CVE-2022-48657
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: topology: fix possible overflow in amu_fie_setup()

cpufreq_get_hw_max_freq() returns max frequency in kHz as *unsigned int*,
while freq_inv_set_max_ratio() gets passed this frequency in Hz as 'u64'.
Multiplying max frequency by 1000 can potentially result in overflow --
multiplying by 1000ULL instead should avoid that...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/3c3edb82d67b2be9231174ac2af4af60d4af7549; https://git.kernel.org/stable/c/904f881b57360cf85de962d84d8614d94431f60e; https://git.kernel.org/stable/c/bb6d99e27cbe6b30e4e3bbd32927fd3b0bdec6eb
CVE: CVE-2022-48658
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context.

Commit 5a836bf6b09f ("mm: slub: move flush_cpu_slab() invocations
__free_slab() invocations out of IRQ context") moved all flush_cpu_slab()
invocations to the global workqueue to avoid a problem related
with deactivate_slab()/__free_slab() being called from an IRQ context
on PREEMPT_RT kernels.

When the flush_all_cpu_locked() function is called from a task context
it may happen that a workqueue with WQ_MEM_RECLAIM bit set ends up
flushing the global workqueue, this will cause a dependency issue.

 workqueue: WQ_MEM_RECLAIM nvme-delete-wq:nvme_delete_ctrl_work [nvme_core]
   is flushing !WQ_MEM_RECLAIM events:flush_cpu_slab
 WARNING: CPU: 37 PID: 410 at kernel/workqueue.c:2637
   check_flush_dependency+0x10a/0x120
 Workqueue: nvme-delete-wq nvme_delete_ctrl_work [nvme_core]
 RIP: 0010:check_flush_dependency+0x10a/0x120[  453.262125] Call Trace:
 __flush_work.isra.0+0xbf/0x220
 ? __queue_work+0x1dc/0x420
 flush_all_cpus_locked+0xfb/0x120
 __kmem_cache_shutdown+0x2b/0x320
 kmem_cache_destroy+0x49/0x100
 bioset_exit+0x143/0x190
 blk_release_queue+0xb9/0x100
 kobject_cleanup+0x37/0x130
 nvme_fc_ctrl_free+0xc6/0x150 [nvme_fc]
 nvme_free_ctrl+0x1ac/0x2b0 [nvme_core]

Fix this bug by creating a workqueue for the flush operation with
the WQ_MEM_RECLAIM bit set.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/61703b248be993eb4997b00ae5d3318e6d8f3c5b; https://git.kernel.org/stable/c/df6cb39335cf5a1b918e8dbd8ba7cd9f1d00e45a; https://git.kernel.org/stable/c/e45cc288724f0cfd497bb5920bcfa60caa335729
CVE: CVE-2022-48659
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/slub: fix to return errno if kmalloc() fails

In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to
out-of-memory, if it fails, return errno correctly rather than
triggering panic via BUG_ON();

kernel BUG at mm/slub.c:5893!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP

Call trace:
 sysfs_slab_add+0x258/0x260 mm/slub.c:5973
 __kmem_cache_create+0x60/0x118 mm/slub.c:4899
 create_cache mm/slab_common.c:229 [inline]
 kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335
 kmem_cache_create+0x1c/0x28 mm/slab_common.c:390
 f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]
 f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808
 f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149
 mount_bdev+0x1b8/0x210 fs/super.c:1400
 f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512
 legacy_get_tree+0x30/0x74 fs/fs_context.c:610
 vfs_get_tree+0x40/0x140 fs/super.c:1530
 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040
 path_mount+0x358/0x914 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/016b150992eebc32c4a18f783cf2bb6e2545a3d9; https://git.kernel.org/stable/c/02bcd951aa3c2cea95fb241c20802e[PII_REDACTED]; https://git.kernel.org/stable/c/2d6e55e0c03804e1e227b80a5746e086d6c6696c
CVE: CVE-2022-48660
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully

When running gpio test on nxp-ls1028 platform with below command
gpiomon --num-events=3 --rising-edge gpiochip1 25
There will be a warning trace as below:
Call trace:
free_irq+0x204/0x360
lineevent_free+0x64/0x70
gpio_ioctl+0x598/0x6a0
__arm64_sys_ioctl+0xb4/0x100
invoke_syscall+0x5c/0x130
......
el0t_64_sync+0x1a0/0x1a4
The reason of this issue is that calling request_threaded_irq()
function failed, and then lineevent_free() is invoked to release
the resource. Since the lineevent_state::irq was already set, so
the subsequent invocation of free_irq() would trigger the above
warning call trace. To fix this issue, set the lineevent_state::irq
after the IRQ register successfully.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/657803b918e097e47d99d1489da83a603c36bcdd; https://git.kernel.org/stable/c/69bef19d6b9700e96285f4b4e28691cda3dcd0d1; https://git.kernel.org/stable/c/97da736cd11ae73bdf2f5e21e24446b8349e0168
CVE: CVE-2022-48661
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

gpio: mockup: Fix potential resource leakage when register a chip

If creation of software node fails, the locally allocated string
array is left unfreed. Free it on error path.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://git.kernel.org/stable/c/02743c4091ccfb246f5cdbbe3f44b152d5d12933; https://git.kernel.org/stable/c/41f857033c44442a27f591fda8d986e7c9e42872; https://git.kernel.org/stable/c/9b26723e058faaf11b532fb4aa16d6849d581790
CVE: CVE-2022-48663
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

gpio: mockup: fix NULL pointer dereference when removing debugfs

We now remove the device's debugfs entries when unbinding the driver.
This now causes a NULL-pointer dereference on module exit because the
platform devices are unregistered *after* the global debugfs directory
has been recursively removed. Fix it by unregistering the devices first.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/18352095a0d581f6aeb1e9fc9d68cc0152cd64b4; https://git.kernel.org/stable/c/af0bfabf06c74c260265c30ba81a34e7dec0e881; https://git.kernel.org/stable/c/b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68
CVE: CVE-2022-48665
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

exfat: fix overflow for large capacity partition

Using int type for sector index, there will be overflow in a large
capacity partition.

For example, if storage with sector size of 512 bytes and partition
capacity is larger than 2TB, there will be overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://git.kernel.org/stable/c/17244f71765dfec39e[PII_REDACTED]3e896c376d09; https://git.kernel.org/stable/c/2e9ceb6728f1dc2fa4b5d08f37d88cbc49a20a62; https://git.kernel.org/stable/c/17244f71765dfec39e[PII_REDACTED]3e896c376d09
CVE: CVE-2022-48666
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix a use-after-free

There are two .exit_cmd_priv implementations. Both implementations use
resources associated with the SCSI host. Make sure that these resources are
still available when .exit_cmd_priv is called by waiting inside
scsi_remove_host() until the tag set has been freed.

This commit fixes the following use-after-free:

==================================================================
BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
Read of size 8 at addr ffff[PII_REDACTED]00 by task multipathd/16727
Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x44
 print_report.cold+0x5e/0x5db
 kasan_report+0xab/0x120
 srp_exit_cmd_priv+0x27/0xd0 [ib_srp]
 scsi_mq_exit_request+0x4d/0x70
 blk_mq_free_rqs+0x143/0x410
 __blk_mq_free_map_and_rqs+0x6e/0x100
 blk_mq_free_tag_set+0x2b/0x160
 scsi_host_dev_release+0xf3/0x1a0
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 scsi_device_dev_release_usercontext+0x4c1/0x4e0
 execute_in_process_context+0x23/0x90
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 scsi_disk_release+0x3f/0x50
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 disk_release+0x17f/0x1b0
 device_release+0x54/0xe0
 kobject_put+0xa5/0x120
 dm_put_table_device+0xa3/0x160 [dm_mod]
 dm_put_device+0xd0/0x140 [dm_mod]
 free_priority_group+0xd8/0x110 [dm_multipath]
 free_multipath+0x94/0xe0 [dm_multipath]
 dm_table_destroy+0xa2/0x1e0 [dm_mod]
 __dm_destroy+0x196/0x350 [dm_mod]
 dev_remove+0x10c/0x160 [dm_mod]
 ctl_ioctl+0x2c2/0x590 [dm_mod]
 dm_ctl_ioctl+0x5/0x10 [dm_mod]
 __x64_sys_ioctl+0xb4/0xf0
 dm_ctl_ioctl+0x5/0x10 [dm_mod]
 __x64_sys_ioctl+0xb4/0xf0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
CVSS Score: 7.4 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2e7eb4c1e8af8385de22775bd0be552f59b28c9a; https://git.kernel.org/stable/c/5ce8fad941233e81f2afb5b52a3fcddd3ba8732f; https://git.kernel.org/stable/c/8fe4ce5836e932f5766317cb651c1ff2a4cd0506
CVE: CVE-2022-48667
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

smb3: fix temporary data corruption in insert range

insert range doesn't discard the affected cached region
so can risk temporarily corrupting file data.

Also includes some minor cleanup (avoiding rereading
inode size repeatedly unnecessarily) to make it clearer.
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/0cdde8460c304283d4ebe3f767a70215d1ab9d4e; https://git.kernel.org/stable/c/9c8b7a293f50253e694f19161c045817a938e551; https://git.kernel.org/stable/c/0cdde8460c304283d4ebe3f767a70215d1ab9d4e
CVE: CVE-2022-48668
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

smb3: fix temporary data corruption in collapse range

collapse range doesn't discard the affected cached region
so can risk temporarily corrupting the file data. This
fixes xfstest generic/031

I also decided to merge a minor cleanup to this into the same patch
(avoiding rereading inode size repeatedly unnecessarily) to make it
clearer.
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/49523a4732204bdacbf3941a016503ddb4ddb3b9; https://git.kernel.org/stable/c/fa30a81f255a56cccd89552cd6ce7ea6e8d8acc4; https://git.kernel.org/stable/c/49523a4732204bdacbf3941a016503ddb4ddb3b9
CVE: CVE-2024-25050
Published: 2024-04-28
Description: IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio for i 7.2, 7.3, 7.4, 7.5 networking and compiler infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privileges.  IBM X-Force ID:  283242.
CVSS Score: 8.4 (HIGH)
CWE: CWE-427
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/283242; https://www.ibm.com/support/pages/node/7149616; https://www.ibm.com/support/pages/node/7149672
CVE: CVE-2024-33883
Published: 2024-04-28
Description: The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-693
References: https://github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5; https://github.com/mde/ejs/compare/v3.1.9...v3.1.10; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-33331
Published: 2024-04-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-33891. Reason: This candidate is a reservation duplicate of CVE-2024-33891. Notes: All CVE users should reference CVE-2024-33891 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-33891
Published: 2024-04-28
Description: Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.
CVSS Score: 8.8 (HIGH)
CWE: CWE-321
References: https://delinea.com/products/secret-server; https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000001.htm; https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3
CVE: CVE-2024-33899
Published: 2024-04-29
Description: RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
CVSS Score: 7.1 (HIGH)
CWE: CWE-150
References: https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983; https://www.rarlab.com/rarnew.htm; https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983
CVE: CVE-2024-33903
Published: 2024-04-29
Description: In CARLA through 0.9.15.2, the collision sensor mishandles some situations involving pedestrians or bicycles, in part because the collision sensor function is not exposed to the Blueprint library.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-693
References: https://github.com/carla-simulator/carla/blob/60bd026b4822b4edb8a68cc17b9119866f303853/Docs/core_concepts.md; https://github.com/carla-simulator/carla/issues/7025; https://github.com/carla-simulator/carla/issues/7394#issuecomment[PII_REDACTED]
CVE: CVE-2024-4296
Published: 2024-04-29
Description: The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7765-49906-1.html; https://www.twcert.org.tw/tw/cp-132-7765-49906-1.html
CVE: CVE-2024-4297
Published: 2024-04-29
Description: The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html; https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html
CVE: CVE-2024-4298
Published: 2024-04-29
Description: The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290; https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851; https://www.twcert.org.tw/tw/cp-132-7769-0773a-1.html
CVE: CVE-2024-1874
Published: 2024-04-29
Description: In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-116
References: http://www.openwall.com/lists/oss-security/2024/04/12/11; http://www.openwall.com/lists/oss-security/2024/06/07/1; https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7
CVE: CVE-2024-2756
Published: 2024-04-29
Description: Due to an incomplete fix to  CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2024/04/12/11; https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4; https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html
CVE: CVE-2024-2757
Published: 2024-04-29
Description: In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2024/04/12/11; https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-3096
Published: 2024-04-29
Description: In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2024/04/12/11; https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr; https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html
CVE: CVE-2024-4299
Published: 2024-04-29
Description: The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290; https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851; https://www.twcert.org.tw/tw/cp-132-7771-36c50-1.html
CVE: CVE-2024-4300
Published: 2024-04-29
Description: E-WEBInformationCo. FS-EZViewer(Web) exposes sensitive information in the service. A remote attacker can obtain the database configuration file path through the webpage source code without login. Accessing this path allows attacker to obtain the database credential with the highest privilege and database host IP address. With this information, attackers can connect to the database and perform actions such as adding, modifying, or deleting database contents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://www.twcert.org.tw/tw/cp-132-7774-fbd01-1.html; https://www.twcert.org.tw/tw/cp-132-7774-fbd01-1.html
CVE: CVE-2024-4301
Published: 2024-04-29
Description: N-Reporter and N-Cloud, products of the N-Partner, have an OS Command Injection vulnerability. Remote attackers with normal user privilege can execute arbitrary system commands by manipulating user inputs on a specific page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7776-035ff-1.html; https://www.twcert.org.tw/tw/cp-132-7776-035ff-1.html
CVE: CVE-2024-33339
Published: 2024-04-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.