deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-25159
Published: 2024-02-04
Description: A vulnerability was found in mpedraza2020 Intranet del Monterroso up to 4.50.0. It has been classified as critical. This affects an unknown part of the file config/cargos.php. The manipulation of the argument dni_profe leads to sql injection. Upgrading to version 4.51.0 is able to address this issue. The identifier of the patch is 678190bee1dfd64b54a2b0e88abfd009e78adce8. It is recommended to upgrade the affected component. The identifier VDB-252717 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/mpedraza2020/IESMONTEROSOINTRANET/commit/678190bee1dfd64b54a2b0e88abfd009e78adce8; https://github.com/mpedraza2020/IESMONTEROSOINTRANET/releases/tag/v4.51.0; https://vuldb.com/?ctiid.252717
CVE: CVE-2023-6240
Published: 2024-02-04
Description: A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://access.redhat.com/errata/RHSA-2024:1881; https://access.redhat.com/errata/RHSA-2024:1882; https://access.redhat.com/errata/RHSA-2024:2758
CVE: CVE-2024-25062
Published: 2024-02-04
Description: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://gitlab.gnome.org/GNOME/libxml2/-/issues/604; https://gitlab.gnome.org/GNOME/libxml2/-/tags; https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
CVE: CVE-2018-25098
Published: 2024-02-04
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in blockmason credit-protocol. It has been declared as problematic. Affected by this vulnerability is the function executeUcacTx of the file contracts/CreditProtocol.sol of the component UCAC Handler. The manipulation leads to denial of service. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 082e01f18707ef995e80ebe97fcedb229a55efc5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252799. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-672
References: https://github.com/blockmason/credit-protocol/commit/082e01f18707ef995e80ebe97fcedb229a55efc5; https://github.com/blockmason/credit-protocol/pull/33; https://vuldb.com/?ctiid.252799
CVE: CVE-2020-36773
Published: 2024-02-04
Description: Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-787, CWE-416, CWE-787
References: https://bugs.ghostscript.com/show_bug.cgi?id=702229; https://bugzilla.opensuse.org/show_bug.cgi?id=1177922; https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=8c7bd787defa071c96289b7da9397f673fddb874
CVE: CVE-2021-4435
Published: 2024-02-04
Description: An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
CVSS Score: 7.7 (HIGH)
CWE: CWE-426, CWE-426
References: https://access.redhat.com/security/cve/CVE-2021-4435; https://bugzilla.redhat.com/show_bug.cgi?id=2262284; https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1
CVE: CVE-2023-52425
Published: 2024-02-04
Description: libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.openwall.com/lists/oss-security/2024/03/20/5; https://github.com/libexpat/libexpat/pull/789; https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html
CVE: CVE-2023-52426
Published: 2024-02-04
Description: libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-776, CWE-776
References: https://cwe.mitre.org/data/definitions/776.html; https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404; https://github.com/libexpat/libexpat/pull/777
CVE: CVE-2021-46902
Published: 2024-02-04
Description: An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. Path validation is mishandled, and thus an admin can read or delete files in violation of expected access controls.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-03-meinberg-lantime-firmware-v7-04-008-und-v6-24-029.htm; https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-03-meinberg-lantime-firmware-v7-04-008-und-v6-24-029.htm
CVE: CVE-2021-46903
Published: 2024-02-04
Description: An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. An admin can delete required user accounts (in violation of expected access control).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-03-meinberg-lantime-firmware-v7-04-008-und-v6-24-029.htm; https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-03-meinberg-lantime-firmware-v7-04-008-und-v6-24-029.htm
CVE: CVE-2024-25089
Published: 2024-02-04
Description: Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://hackerone.com/reports/2300061; https://www.binisoft.org/changelog.txt; https://hackerone.com/reports/2300061
CVE: CVE-2023-47170
Published: 2024-02-05
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2023.
CVE: CVE-2023-51504
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Dulaney Dan's Embedder for Google Calendar allows Stored XSS.This issue affects Dan's Embedder for Google Calendar: from n/a through 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dans-gcal/wordpress-dan-s-embedder-for-google-calendar-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dans-gcal/wordpress-dan-s-embedder-for-google-calendar-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5677
Published: 2024-02-05
Description: Brandon
Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. The impact of exploiting
this vulnerability is lower with operator-privileges compared to
administrator-privileges service accounts. Please refer to the Axis security advisory
for more information and solution.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78, CWE-94
References: https://www.axis.com/dam/public/0a/47/d1/cve-2023-5677-en-US-483444.pdf; https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf
CVE: CVE-2023-5800
Published: 2024-02-05
Description: Vintage,
member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. Axis has released patched AXIS OS
versions for the highlighted flaw. Please refer to the Axis security advisory
for more information and solution.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-35, CWE-94
References: https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf; https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf
CVE: CVE-2024-20001
Published: 2024-02-05
Description: In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03961601; Issue ID: DTV03961601.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20002
Published: 2024-02-05
Description: In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03961715; Issue ID: DTV03961715.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20003
Published: 2024-02-05
Description: In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Connection Setup message, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01191612; Issue ID: MOLY01191612 (MSV-981).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20004
Published: 2024-02-05
Description: In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Connection Setup message, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01191612; Issue ID: MOLY01195812 (MSV-985).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20006
Published: 2024-02-05
Description: In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08477148; Issue ID: ALPS08477148.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20007
Published: 2024-02-05
Description: In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08441369; Issue ID: ALPS08441369.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-787, CWE-362
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20009
Published: 2024-02-05
Description: In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08441150; Issue ID: ALPS08441150.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20010
Published: 2024-02-05
Description: In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08358560; Issue ID: ALPS08358560.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20011
Published: 2024-02-05
Description: In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441146; Issue ID: ALPS08441146.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20012
Published: 2024-02-05
Description: In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08358566; Issue ID: ALPS08358566.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20013
Published: 2024-02-05
Description: In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08471742; Issue ID: ALPS08308608.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20015
Published: 2024-02-05
Description: In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441419; Issue ID: ALPS08441419.
CVSS Score: 7.8 (HIGH)
CWE: CWE-305
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-20016
Published: 2024-02-05
Description: In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation Patch ID: ALPS07835901; Issue ID: ALPS07835901.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2024; https://corp.mediatek.com/product-security-bulletin/February-2024
CVE: CVE-2024-24866
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/biteship/wordpress-biteship-plugin-2-2-24-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/biteship/wordpress-biteship-plugin-2-2-24-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24870
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-iframe/wordpress-advanced-iframe-plugin-2023-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-iframe/wordpress-advanced-iframe-plugin-2023-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-7077
Published: 2024-02-05
Description: Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8) allows an attacker execute remote code by sending unintended parameters in http request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://sharp-displays.jp.sharp/global/support/info/A4_vulnerability.html; https://www.sharp-nec-displays.com/global/support/info/A4_vulnerability.html
CVE: CVE-2024-24838
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Reviews allows Stored XSS.This issue affects Five Star Restaurant Reviews: from n/a through 2.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/good-reviews-wp/wordpress-five-star-restaurant-reviews-plugin-2-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/good-reviews-wp/wordpress-five-star-restaurant-reviews-plugin-2-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24839
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.6.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/structured-content/wordpress-structured-content-json-ld-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/structured-content/wordpress-structured-content-json-ld-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24841
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan's Art Add Customer for WooCommerce allows Stored XSS.This issue affects Add Customer for WooCommerce: from n/a through 1.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/add-customer-for-woocommerce/wordpress-add-customer-for-woocommerce-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/add-customer-for-woocommerce/wordpress-add-customer-for-woocommerce-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24846
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MightyThemes Mighty Addons for Elementor allows Reflected XSS.This issue affects Mighty Addons for Elementor: from n/a through 1.9.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/mighty-addons/wordpress-mighty-addons-for-elementor-plugin-1-9-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mighty-addons/wordpress-mighty-addons-for-elementor-plugin-1-9-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24847
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgadbois CalculatorPro Calculators allows Reflected XSS.This issue affects CalculatorPro Calculators: from n/a through 1.1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/calculatorpro-calculators/wordpress-calculatorpro-calculators-plugin-1-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/calculatorpro-calculators/wordpress-calculatorpro-calculators-plugin-1-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24848
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a through 1.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ptoffice-sign-ups/wordpress-pt-sign-ups-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ptoffice-sign-ups/wordpress-pt-sign-ups-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-24865
Published: 2024-02-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan Scroll Triggered Box allows Stored XSS.This issue affects Scroll Triggered Box: from n/a through 2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/dreamgrow-scroll-triggered-box/wordpress-scroll-triggered-box-plugin-2-3-cross-site-scripting-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dreamgrow-scroll-triggered-box/wordpress-scroll-triggered-box-plugin-2-3-cross-site-scripting-vulnerability?_s_id=cve
CVE: CVE-2024-22386
Published: 2024-02-05
Description: A race condition was found in the Linux kernel's drm/exynos device driver in exynos_drm_crtc_atomic_disable() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362, CWE-362, CWE-476
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=8147; https://bugzilla.openanolis.cn/show_bug.cgi?id=8147
CVE: CVE-2024-22667
Published: 2024-02-05
Description: Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://gist.githubusercontent.com/henices/2467e7f22dcc2aa97a2453e197b55a0c/raw/7b54bccc9a129c604fb139266f4497ab7aaa94c7/gistfile1.txt; https://github.com/vim/vim/commit/b39b240c386a5a[PII_REDACTED]1f1c99e2e6b8ce47; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UI44Y4LJLG34D4HNB6NTPLUPZREHAEL7/
CVE: CVE-2024-23196
Published: 2024-02-05
Description: A race condition was found in the Linux kernel's sound/hda  device driver in snd_hdac_regmap_sync() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362, CWE-362, CWE-476
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=8148; https://bugzilla.openanolis.cn/show_bug.cgi?id=8148
CVE: CVE-2024-24855
Published: 2024-02-05
Description: A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.





CVSS Score: 5.0 (MEDIUM)
CWE: CWE-362, CWE-362, CWE-476
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=8149; https://bugzilla.openanolis.cn/show_bug.cgi?id=8149; https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html