deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23058
Published: 2024-01-11
Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/6/TOTOlink%20A3300R%20setTr069Cfg.md; https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/6/TOTOlink%20A3300R%20setTr069Cfg.md
CVE: CVE-2024-23059
Published: 2024-01-11
Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/2/TOTOlink%20A3300R%20setDdnsCfg.md; https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/2/TOTOlink%20A3300R%20setDdnsCfg.md
CVE: CVE-2024-23060
Published: 2024-01-11
Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/4/TOTOLINK%20A3300R%20setDmzCfg.md; https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/4/TOTOLINK%20A3300R%20setDmzCfg.md
CVE: CVE-2024-23061
Published: 2024-01-11
Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/3/TOTOLINK%20A3300R%20setScheduleCfg.md; https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/3/TOTOLINK%20A3300R%20setScheduleCfg.md
CVE: CVE-2023-50671
Published: 2024-01-11
Description: In exiftags 1.01, nikon_prop1 in nikon.c has a heap-based buffer overflow (write of size 28) because snprintf can write to an unexpected address.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://blog.yulun.ac.cn/posts/2023/fuzzing-exiftags/; https://johnst.org/sw/exiftags/; https://blog.yulun.ac.cn/posts/2023/fuzzing-exiftags/
CVE: CVE-2024-0411
Published: 2024-01-11
Description: A vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown part of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250431.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://note.zhaoj.in/share/9G6K6RBjS4M4; https://vuldb.com/?ctiid.250431; https://vuldb.com/?id.250431
CVE: CVE-2024-0412
Published: 2024-01-11
Description: A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250432.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://note.zhaoj.in/share/Q56cf5nN9RzF; https://vuldb.com/?ctiid.250432; https://vuldb.com/?id.250432
CVE: CVE-2024-0413
Published: 2024-01-11
Description: A vulnerability was found in DeShang DSKMS up to 3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file public/install.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250433 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://note.zhaoj.in/share/MarH4fY66BgO; https://vuldb.com/?ctiid.250433; https://vuldb.com/?id.250433
CVE: CVE-2024-0414
Published: 2024-01-11
Description: A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250434 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://note.zhaoj.in/share/xYQMsARg83ui; https://vuldb.com/?ctiid.250434; https://vuldb.com/?id.250434
CVE: CVE-2024-0415
Published: 2024-01-11
Description: A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an unknown functionality of the file application/home/controller/TaobaoExport.php of the component Image URL Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250435.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://note.zhaoj.in/share/63LhFitJmKGR; https://vuldb.com/?ctiid.250435; https://vuldb.com/?id.250435
CVE: CVE-2024-0416
Published: 2024-01-11
Description: A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/controller/MemberAuth.php. The manipulation of the argument file_name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-24
References: https://note.zhaoj.in/share/DxR7FZsCKJQ1; https://vuldb.com/?ctiid.250436; https://vuldb.com/?id.250436
CVE: CVE-2024-0417
Published: 2024-01-11
Description: A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The manipulation of the argument member_info leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250437 was assigned to this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-24
References: https://note.zhaoj.in/share/ZpRTCLblKd7N; https://vuldb.com/?ctiid.250437; https://vuldb.com/?id.250437
CVE: CVE-2024-0418
Published: 2024-01-11
Description: A vulnerability has been found in iSharer and upRedSun File Sharing Wizard up to 1.5.0 and classified as problematic. This vulnerability affects unknown code of the component GET Request Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250438 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://vuldb.com/?ctiid.250438; https://vuldb.com/?id.250438
CVE: CVE-2024-22197
Published: 2024-01-11
Description: Nginx-ui is online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue has been patched in version 2.0.0.beta.9.
CVSS Score: 7.7 (HIGH)
CWE: CWE-77
References: https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3; https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m; https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3
CVE: CVE-2024-22199
Published: 2024-01-11
Description: This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.

CVSS Score: 9.3 (CRITICAL)
CWE: CWE-20, CWE-79, CWE-116
References: https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b[PII_REDACTED]d624b6cb46; https://github.com/gofiber/template/security/advisories/GHSA-4mq2-gc4j-cmw6; https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b[PII_REDACTED]d624b6cb46
CVE: CVE-2023-51780
Published: 2024-01-11
Description: An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8; https://github.com/torvalds/linux/commit/24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE: CVE-2023-51781
Published: 2024-01-11
Description: An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8; https://github.com/torvalds/linux/commit/189ff16722ee36ced4d2a2469d4ab65a8fee4198; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE: CVE-2023-51782
Published: 2024-01-11
Description: An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8; https://github.com/torvalds/linux/commit/810c38a369a0a0ce625b5c12169abce1dd9ccd53; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE: CVE-2024-0419
Published: 2024-01-11
Description: A vulnerability was found in Jasper httpdx up to 1.5.4 and classified as problematic. This issue affects some unknown processing of the component HTTP POST Request Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250439.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://vuldb.com/?ctiid.250439; https://vuldb.com/?id.250439
CVE: CVE-2024-0422
Published: 2024-01-11
Description: A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /new_item of the component New Item Creation Page. The manipulation of the argument new_item leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250441 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1_CoeXcCC8fXzKJO-Xvjuq1qYtf8QKHaM/view?usp=sharing; https://vuldb.com/?ctiid.250441; https://vuldb.com/?id.250441
CVE: CVE-2024-0227
Published: 2024-01-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-0423
Published: 2024-01-11
Description: A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file dishes.php. The manipulation of the argument res_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250442 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1SaHrOPMV6yrBaS5pA7MOX8nsiVGxvlOa/view?usp=sharing; https://vuldb.com/?ctiid.250442; https://vuldb.com/?id.250442
CVE: CVE-2024-0424
Published: 2024-01-11
Description: A vulnerability classified as problematic has been found in CodeAstro Simple Banking System 1.0. This affects an unknown part of the file createuser.php of the component Create a User Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250443.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1jr5YRrESDjcNmhpQRK5yHvvxNlYJp2oK/view?usp=sharing; https://vuldb.com/?ctiid.250443; https://vuldb.com/?id.250443
CVE: CVE-2024-0425
Published: 2024-01-11
Description: A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250444.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640
References: https://github.com/mi2acle/forucmsvuln/blob/master/passwordreset.md; https://vuldb.com/?ctiid.250444; https://vuldb.com/?id.250444
CVE: CVE-2024-22196
Published: 2024-01-11
Description: Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.


CVSS Score: 7.0 (HIGH)
CWE: CWE-89
References: https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b; https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879c; https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b
CVE: CVE-2024-22198
Published: 2024-01-11
Description: Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn't allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-77
References: https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/system/settings.go#L18; https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/terminal/pty.go#L11; https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/internal/pty/pipeline.go#L29
CVE: CVE-2022-4959
Published: 2024-01-11
Description: A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0. Affected by this vulnerability is an unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250237 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/qkmc-rk/redbbs/issues/2; https://vuldb.com/?ctiid.250237; https://vuldb.com/?id.250237
CVE: CVE-2023-50123
Published: 2024-01-11
Description: The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brute force on the SMS authentication, to bring the alarm system to a disarmed state.
CVSS Score: 8.1 (HIGH)
CWE: CWE-307, CWE-307
References: https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices; https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE: CVE-2023-50124
Published: 2024-01-11
Description: Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design choices, an attacker can unlock the Flient Smart Door Lock by replacing the fingerprint that is stored on the scanner.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices; https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE: CVE-2023-50125
Published: 2024-01-11
Description: A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices; https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE: CVE-2023-50126
Published: 2024-01-11
Description: Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one of the original tags, which results in an attacker being able to bring the alarm system to a disarmed state.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices; https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE: CVE-2023-50127
Published: 2024-01-11
Description: Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone numbers, which allows an attacker to bring the alarm system to a disarmed state from any given phone number.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices; https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE: CVE-2023-50128
Published: 2024-01-11
Description: The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which results in an attacker being able to conduct replay attacks to bring the alarm system to a disarmed state.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-294, CWE-294
References: http://hozard.com; https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices; http://hozard.com
CVE: CVE-2023-50129
Published: 2024-01-11
Description: Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags, which results in an attacker gaining access to the perimeter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices; https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices
CVE: CVE-2023-7226
Published: 2024-01-11
Description: A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250232.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-282
References: https://gitee.com/meetyoucrop/big-whale/issues/I6N31K; https://vuldb.com/?ctiid.250232; https://vuldb.com/?id.250232
CVE: CVE-2024-0426
Published: 2024-01-11
Description: A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. This issue affects some unknown processing of the file admin/cms_template.php. The manipulation of the argument t_name/t_path leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250445 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/mi2acle/forucmsvuln/blob/master/sqli.md; https://vuldb.com/?ctiid.250445; https://vuldb.com/?id.250445
CVE: CVE-2024-20675
Published: 2024-01-11
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20675; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20675
CVE: CVE-2023-46474
Published: 2024-01-11
Description: File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: http://pmb.com; https://github.com/Xn2/CVE-2023-46474; http://pmb.com
CVE: CVE-2024-21337
Published: 2024-01-11
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21337; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21337
CVE: CVE-2023-51350
Published: 2024-01-11
Description: A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://github.com/ujcms/ujcms; https://github.com/ujcms/ujcms/issues/7; https://www.ujcms.com/
CVE: CVE-2024-0443
Published: 2024-01-12
Description: A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-402, CWE-668
References: https://access.redhat.com/errata/RHSA-2023:6583; https://access.redhat.com/errata/RHSA-2023:7077; https://access.redhat.com/errata/RHSA-2023:7370
CVE: CVE-2024-21982
Published: 2024-01-12
Description: ONTAP versions 9.4 and higher are susceptible to a vulnerability 
which when successfully exploited could lead to disclosure of sensitive 
information to unprivileged attackers when the object-store profiler 
command is being run by an administrative user.


CVSS Score: 4.8 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/