deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56756
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix freeing of the HMB descriptor table

The HMB descriptor table is sized to the maximum number of descriptors
that could be used for a given device, but __nvme_alloc_host_mem could
break out of the loop earlier on memory allocation failure and end up
using less descriptors than planned for, which leads to an incorrect
size passed to dma_free_coherent.

In practice this was not showing up because the number of descriptors
tends to be low and the dma coherent allocator always allocates and
frees at least a page.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3c2fb1ca8086eb139b2a[PII_REDACTED]25ae8e0d7a; https://git.kernel.org/stable/c/452f9ddd12bebc04cef741e8ba3806bf0e1fd015; https://git.kernel.org/stable/c/582d9ed999b004fb1d415ecbfa86d4d8df455269
CVE: CVE-2024-13013
Published: 2024-12-29
Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Maid Hiring Management System 1.0. Affected is an unknown function of the file /admin/contactus.php of the component Contact Us Page. The manipulation of the argument page title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289704; https://vuldb.com/?id.289704
CVE: CVE-2024-13014
Published: 2024-12-29
Description: A vulnerability has been found in PHPGurukul Maid Hiring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/search-maid.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289705; https://vuldb.com/?id.289705
CVE: CVE-2024-13015
Published: 2024-12-29
Description: A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-booking-request.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289706; https://vuldb.com/?id.289706
CVE: CVE-2024-13016
Published: 2024-12-29
Description: A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/edit-category.php. The manipulation of the argument editid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289707; https://vuldb.com/?id.289707
CVE: CVE-2024-13017
Published: 2024-12-29
Description: A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/aboutus.php of the component About Us Page. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289708; https://vuldb.com/?id.289708
CVE: CVE-2024-13018
Published: 2024-12-29
Description: A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/profile.php. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289709; https://vuldb.com/?id.289709
CVE: CVE-2024-13019
Published: 2024-12-29
Description: A vulnerability classified as problematic has been found in code-projects Chat System 1.0. Affected is an unknown function of the file /admin/update_room.php of the component Chat Room Page. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79, CWE-94
References: https://code-projects.org/; https://vuldb.com/?ctiid.289710; https://vuldb.com/?id.289710
CVE: CVE-2024-13020
Published: 2024-12-29
Description: A vulnerability classified as critical was found in code-projects Chat System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/chatroom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289711; https://vuldb.com/?id.289711
CVE: CVE-2024-13021
Published: 2024-12-29
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Road Accident Map Marker 1.0. Affected by this issue is some unknown functionality of the file /endpoint/add-mark.php. The manipulation of the argument mark_name/details leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/shaturo1337/POCs/blob/main/Stored%20XSS%20Vulnerability%20in%20Road%20Accident%20Map%20Marker.md; https://vuldb.com/?ctiid.289712; https://vuldb.com/?id.289712
CVE: CVE-2024-13022
Published: 2024-12-29
Description: A vulnerability, which was classified as critical, was found in taisan tarzan-cms 1.0.0. This affects the function UploadResponse of the file src/main/java/com/tarzan/cms/modules/admin/controller/common/UploadController.java of the component Article Management. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://gitee.com/taisan/tarzan-cms/issues/IBCUPG; https://vuldb.com/?ctiid.289713; https://vuldb.com/?id.289713
CVE: CVE-2024-13023
Published: 2024-12-29
Description: A vulnerability has been found in PHPGurukul Maid Hiring Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/search-maid.php of the component Search Maid Page. The manipulation of the argument searchdata leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289714; https://vuldb.com/?id.289714
CVE: CVE-2024-13024
Published: 2024-12-29
Description: A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /campaign.php. The manipulation of the argument cname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/isRainy/VULDB/blob/main/Blood_Bank_Management_System.md; https://vuldb.com/?ctiid.289715; https://vuldb.com/?id.289715
CVE: CVE-2024-13025
Published: 2024-12-29
Description: A vulnerability was found in Codezips College Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /Front-end/faculty.php. The manipulation of the argument book_name/book_author leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/shaturo1337/POCs/blob/main/SQL%20Injection%20in%20College%20Management%20System.md; https://vuldb.com/?ctiid.289716; https://vuldb.com/?id.289716
CVE: CVE-2024-13028
Published: 2024-12-29
Description: A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the file /login. The manipulation of the argument username leads to observable response discrepancy. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-203, CWE-204
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/white-jotter/ObservableDiscrepancy-UserLogin.md; https://vuldb.com/?ctiid.289721; https://vuldb.com/?id.289721
CVE: CVE-2024-13029
Published: 2024-12-30
Description: A vulnerability, which was classified as problematic, was found in Antabot White-Jotter up to 0.2.2. Affected is an unknown function of the file /admin/content/book of the component Edit Book Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/white-jotter/ServerSideRequestForgery-BookCoverURL.md; https://vuldb.com/?ctiid.289722; https://vuldb.com/?id.289722
CVE: CVE-2024-13030
Published: 2024-12-30
Description: A vulnerability was found in D-Link DIR-823G 1.0.2B05_20181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientInfo/SetDMZSettings/SetFirewallSettings/SetParentsControlInfo/SetQoSSettings/SetVirtualServerSettings of the file /HNAP1/ of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-284
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-823G/SetAutoRebootSettings.md; https://vuldb.com/?ctiid.289763; https://vuldb.com/?id.289763
CVE: CVE-2024-13031
Published: 2024-12-30
Description: A vulnerability classified as problematic has been found in Antabot White-Jotter up to 0.2.2. Affected is an unknown function of the file /admin/content/editor of the component Article Content Editor. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/white-jotter/ReflectedXSS-ContentEditor.md; https://vuldb.com/?ctiid.289764; https://vuldb.com/?id.289764
CVE: CVE-2024-13032
Published: 2024-12-30
Description: A vulnerability classified as problematic was found in Antabot White-Jotter up to 0.2.2. Affected by this vulnerability is an unknown functionality of the file /admin/content/editor of the component Article Editor. The manipulation of the argument articleCover leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.7 (LOW)
CWE: CWE-918
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/white-jotter/ServerSideRequestForgery-ArticleCoverURL.md; https://vuldb.com/?ctiid.289765; https://vuldb.com/?id.289765
CVE: CVE-2024-13033
Published: 2024-12-30
Description: A vulnerability, which was classified as problematic, has been found in code-projects Chat System 1.0. Affected by this issue is some unknown functionality of the file /admin/chatroom.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://vuldb.com/?ctiid.289766; https://vuldb.com/?id.289766
CVE: CVE-2024-13034
Published: 2024-12-30
Description: A vulnerability, which was classified as problematic, was found in code-projects Chat System 1.0. This affects an unknown part of the file /admin/update_user.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://vuldb.com/?ctiid.289767; https://vuldb.com/?id.289767
CVE: CVE-2024-13035
Published: 2024-12-30
Description: A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/update_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289768; https://vuldb.com/?id.289768
CVE: CVE-2024-13036
Published: 2024-12-30
Description: A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/update_room.php. The manipulation of the argument id/name/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289769; https://vuldb.com/?id.289769
CVE: CVE-2024-13037
Published: 2024-12-30
Description: A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been classified as critical. Affected is the function attendance_report of the file /admin/report.php. The manipulation of the argument course_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/matias-a11y/cve/issues/2; https://vuldb.com/?ctiid.289770
CVE: CVE-2024-13038
Published: 2024-12-30
Description: A vulnerability was found in CodeAstro Simple Loan Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/shaturo1337/POCs/blob/main/Blind%20SQL%20Injection%20in%20Simple%20Loan%20Management%20System.md; https://vuldb.com/?ctiid.289771
CVE: CVE-2024-13039
Published: 2024-12-30
Description: A vulnerability was found in code-projects Simple Chat System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /add_user.php. The manipulation of the argument name/email/password/number leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Curious-L/-/issues/1; https://vuldb.com/?ctiid.289772
CVE: CVE-2024-22063
Published: 2024-12-30
Description: The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices.
CVSS Score: 7.6 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]187627521
CVE: CVE-2024-47917
Published: 2024-12-30
Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47918
Published: 2024-12-30
Description: Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-78
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47919
Published: 2024-12-30
Description: Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47920
Published: 2024-12-30
Description: Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47921
Published: 2024-12-30
Description: Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CVSS Score: 8.4 (HIGH)
CWE: CWE-327
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47922
Published: 2024-12-30
Description: Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47923
Published: 2024-12-30
Description: Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47924
Published: 2024-12-30
Description: Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47925
Published: 2024-12-30
Description: Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47926
Published: 2024-12-30
Description: Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-12993
Published: 2024-12-30
Description: Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An attacker can communicate with the provider and reveal the user’s location without any privileges. 
After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.
CWE: CWE-497
References: https://cert.pl/en/posts/2024/12/CVE-2024-12993/; https://cert.pl/posts/2024/12/CVE-2024-12993/
CVE: CVE-2024-10044
Published: 2024-12-30
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unauthorized web actions or access unauthorized web resources by combining it with the POST /register_worker endpoint.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-918
References: https://huntr.com/bounties/44633540-377d-4ac4-b3a3-c2d0fa19d0e6
CVE: CVE-2024-54181
Published: 2024-12-30
Description: IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.ibm.com/support/pages/node/7179994
CVE: CVE-2024-50701
Published: 2024-12-30
Description: TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266
References: https://github.com/nilsteampassnet/TeamPass/commit/ddbb2d3d94085dced50c4936fd2215af88e4a88d; https://github.com/nilsteampassnet/TeamPass/compare/3.1.2...3.1.3.1; https://github.com/nilsteampassnet/TeamPass/compare/3.1.3...3.1.3.1
CVE: CVE-2024-50702
Published: 2024-12-30
Description: TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266
References: https://github.com/nilsteampassnet/TeamPass/commit/35e2b479f2379545b4132bc30a9d052ba7018bf9; https://github.com/nilsteampassnet/TeamPass/compare/3.1.2...3.1.3.1; https://github.com/nilsteampassnet/TeamPass/compare/3.1.3...3.1.3.1
CVE: CVE-2024-50703
Published: 2024-12-30
Description: TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-472
References: https://github.com/nilsteampassnet/TeamPass/commit/c7f7f809071eaa9e04505ee79cec7049a42959e9; https://github.com/nilsteampassnet/TeamPass/compare/3.1.2...3.1.3.1; https://github.com/nilsteampassnet/TeamPass/compare/3.1.3...3.1.3.1
CVE: CVE-2024-12754
Published: 2024-12-30
Description: AnyDesk Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of background images. By creating a junction, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-23940.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1711/
CVE: CVE-2024-12828
Published: 2024-12-30
Description: Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. 

The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22346.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/webmin/authentic-theme/commit/61e5b10227b50407e3c6ac494ffbd4385d1b59df; https://www.zerodayinitiative.com/advisories/ZDI-24-1725/
CVE: CVE-2024-12834
Published: 2024-12-30
Description: Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of STP files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22414.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1722/