deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20540
Published: 2024-11-06
Description: A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a user of the interface.

This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into a specific page of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. To exploit this vulnerability, the attacker must have at least a Supervisor role on an affected device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccmp-sxss-qBTDBZDD
CVE: CVE-2024-50637
Published: 2024-11-06
Description: UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which can be used to steal cookies.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/unopim/unopim/issues/41; https://github.com/unopim/unopim/releases/tag/v0.1.4; https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md
CVE: CVE-2024-50315
Published: 2024-11-06
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2024. Notes: none.
CVE: CVE-2024-51751
Published: 2024-11-06
Description: Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248
CVE: CVE-2024-51754
Published: 2024-11-06
Description: Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 2.2 (LOW)
CWE: CWE-668
References: https://github.com/twigphp/Twig/commit/2bb8c2460a2c519c498df9b643d[PII_REDACTED]a73; https://github.com/twigphp/Twig/security/advisories/GHSA-6377-hfv9-hqf6; https://lists.debian.org/debian-lts-announce/2025/05/msg00039.html
CVE: CVE-2024-51755
Published: 2024-11-06
Description: Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 2.2 (LOW)
CWE: CWE-668
References: https://github.com/twigphp/Twig/commit/831c148e786178e5f2fde9db67266be3bf241c21; https://github.com/twigphp/Twig/security/advisories/GHSA-jjxq-ff2g-95vh
CVE: CVE-2024-51757
Published: 2024-11-06
Description: happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There are no known workarounds for this vulnerability.
CWE: CWE-79, CWE-94
References: https://github.com/capricorn86/happy-dom/commit/5ee0b1676d4ce20cc2a70d1c9c8d6f1e3f57efac; https://github.com/capricorn86/happy-dom/commit/d23834c232f1cf5519c9418b073f1dcec6b2f0fd; https://github.com/capricorn86/happy-dom/issues/1585
CVE: CVE-2024-51988
Published: 2024-11-06
Description: RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4; https://www.rabbitmq.com/docs/prometheus
CVE: CVE-2024-10926
Published: 2024-11-06
Description: A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /toggle_fold_panel.php of the component Tabelas Section. The manipulation of the argument p leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-74, CWE-79
References: https://docs.google.com/document/d/1h9LlTV1FVvOSDBWc7qwU_5qcboCKd6H99Oqg3rZdBRQ/edit?usp=sharing; https://vuldb.com/?ctiid.283325; https://vuldb.com/?id.283325
CVE: CVE-2024-10941
Published: 2024-11-06
Description: A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-86
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1880879; https://bugzilla.mozilla.org/show_bug.cgi?id=1887614; https://www.mozilla.org/security/advisories/mfsa2024-21/
CVE: CVE-2024-50340
Published: 2024-11-06
Description: symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74
References: https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa; https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j
CVE: CVE-2024-50341
Published: 2024-11-06
Description: symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to  unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-287
References: https://github.com/symfony/symfony/commit/22a0789a0085c3ee96f4ef715ecad8255cf0e105; https://github.com/symfony/symfony/security/advisories/GHSA-jxgr-3v7q-3w9v
CVE: CVE-2024-50342
Published: 2024-11-06
Description: symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b[PII_REDACTED]f5b; https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm
CVE: CVE-2024-50343
Published: 2024-11-06
Description: symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-20
References: https://github.com/symfony/symfony/commit/7d1032bbead9a4229b32fa6ebca32681c80cb76f; https://github.com/symfony/symfony/security/advisories/GHSA-g3rh-rrhp-jhh9; https://lists.debian.org/debian-lts-announce/2025/05/msg00051.html
CVE: CVE-2024-50345
Published: 2024-11-06
Description: symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-601
References: https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp; https://url.spec.whatwg.org; https://lists.debian.org/debian-lts-announce/2025/05/msg00051.html
CVE: CVE-2024-51736
Published: 2024-11-06
Description: Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 0.0 (NONE)
CWE: CWE-77
References: https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q; https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q
CVE: CVE-2024-10927
Published: 2024-11-06
Description: A vulnerability was found in MonoCMS up to 20240528. It has been classified as problematic. Affected is an unknown function of the file /monofiles/account.php of the component Account Information Page. The manipulation of the argument userid leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-74, CWE-79, CWE-79
References: https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20MonoCMS%2[PII_REDACTED]8%20-%20(account.php).md; https://vuldb.com/?ctiid.283326; https://vuldb.com/?id.283326
CVE: CVE-2024-10928
Published: 2024-11-06
Description: A vulnerability was found in MonoCMS up to 20240528. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /monofiles/opensaved.php of the component Posts Page. The manipulation of the argument filtcategory/filtstatus leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-74, CWE-79, CWE-79
References: https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20MonoCMS%2[PII_REDACTED]8%20-%20(opensaved.php).md; https://vuldb.com/?ctiid.283327; https://vuldb.com/?id.283327
CVE: CVE-2024-48325
Published: 2024-11-06
Description: Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/osvaldotenorio/cve-2024-48325
CVE: CVE-2024-51409
Published: 2024-11-06
Description: Buffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of service via a network packet in a fixed format to a router running the corresponding version of the firmware.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/fireknight-hJ/Tenda-cve-pocs/blob/main/Tenda%20O3V1.0.0.5%284180%29/websReadEvent.md
CVE: CVE-2024-51990
Published: 2024-11-07
Description: jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.
CWE: CWE-22
References: https://github.com/martinvonz/jj/security/advisories/GHSA-88h5-6w7m-5w56
CVE: CVE-2024-10922
Published: 2024-11-07
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-51647. Reason: This candidate is a reservation duplicate of CVE-2024-51647. Notes: All CVE users should reference CVE-2024-51647 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-10946
Published: 2024-11-07
Description: A vulnerability classified as critical has been found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System up to 2.0.1. This affects an unknown part of the file /interlib/admin/SysLib?cmdACT=inputLIBCODE&mod=batchXSL&xsl=editLIBCODE.xsl&libcodes=&ROWID=. The manipulation of the argument sql leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.283365; https://vuldb.com/?id.283365; https://vuldb.com/?submit.434449
CVE: CVE-2024-10947
Published: 2024-11-07
Description: A vulnerability classified as critical was found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System up to 2.0.1. This vulnerability affects unknown code of the file /interlib/order/BatchOrder?cmdACT=admin_order&xsl=adminOrder_OrderList.xsl. The manipulation of the argument bookrecno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.283366; https://vuldb.com/?id.283366; https://vuldb.com/?submit.434450
CVE: CVE-2024-10027
Published: 2024-11-07
Description: The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a94c7b64-720a-47f1-a74a-691c3a9ed3a1/
CVE: CVE-2024-38286
Published: 2024-11-07
Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.


The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.



Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
CVSS Score: 8.6 (HIGH)
CWE: CWE-770
References: https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s; http://www.openwall.com/lists/oss-security/2024/09/23/2; https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
CVE: CVE-2024-30140
Published: 2024-11-07
Description: HCL BigFix Compliance is affected by unvalidated redirects and forwards.  The HOST header can be manipulated by an attacker and as a result, it can poison the web cache and provide back to users being served the page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117197
CVE: CVE-2024-30141
Published: 2024-11-07
Description: HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information.  Detailed error messages can provide enticement information or expose information about its environment, users, or associated data.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-209
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117197
CVE: CVE-2024-30142
Published: 2024-11-07
Description: HCL BigFix Compliance is affected by a missing secure flag on a cookie.  If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.
CVSS Score: 3.8 (LOW)
CWE: CWE-614
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117197
CVE: CVE-2023-1932
Published: 2024-11-07
Description: A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/CVE-2023-1932; https://bugzilla.redhat.com/show_bug.cgi?id=1809444
CVE: CVE-2023-1973
Published: 2024-11-07
Description: A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2024:1674; https://access.redhat.com/errata/RHSA-2024:1675; https://access.redhat.com/errata/RHSA-2024:1676
CVE: CVE-2024-10203
Published: 2024-11-07
Description: Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://www.manageengine.com/products/desktop-central/cve-2024-10203.html
CVE: CVE-2024-50139
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix shift-out-of-bounds bug

Fix a shift-out-of-bounds bug reported by UBSAN when running
VM with MTE enabled host kernel.

UBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14
shift exponent 33 is too large for 32-bit type 'int'
CPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34
Hardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024
Call trace:
 dump_backtrace+0xa0/0x128
 show_stack+0x20/0x38
 dump_stack_lvl+0x74/0x90
 dump_stack+0x18/0x28
 __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0
 reset_clidr+0x10c/0x1c8
 kvm_reset_sys_regs+0x50/0x1c8
 kvm_reset_vcpu+0xec/0x2b0
 __kvm_vcpu_set_target+0x84/0x158
 kvm_vcpu_set_target+0x138/0x168
 kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0
 kvm_arch_vcpu_ioctl+0x28c/0x4b8
 kvm_vcpu_ioctl+0x4bc/0x7a8
 __arm64_sys_ioctl+0xb4/0x100
 invoke_syscall+0x70/0x100
 el0_svc_common.constprop.0+0x48/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x3c/0x158
 el0t_64_sync_handler+0x120/0x130
 el0t_64_sync+0x194/0x198
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/04ed2ba07ce73f323052475fbd33d647aca3ff2e; https://git.kernel.org/stable/c/4b9e11794d910aa55300debbac5f0adcc42c491a; https://git.kernel.org/stable/c/c6c167afa090ea0451f91814e1318755a8fb8bb9
CVE: CVE-2024-50140
Published: 2024-11-07
Description: In the Linux kernel, the following vulnerability has been resolved:

sched/core: Disable page allocation in task_tick_mm_cid()

With KASAN and PREEMPT_RT enabled, calling task_work_add() in
task_tick_mm_cid() may cause the following splat.

[   63.696416] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
[   63.696416] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 610, name: modprobe
[   63.696416] preempt_count: 10001, expected: 0
[   63.696416] RCU nest depth: 1, expected: 1

This problem is caused by the following call trace.

  sched_tick() [ acquire rq->__lock ]
   -> task_tick_mm_cid()
    -> task_work_add()
     -> __kasan_record_aux_stack()
      -> kasan_save_stack()
       -> stack_depot_save_flags()
        -> alloc_pages_mpol_noprof()
         -> __alloc_pages_noprof()
	  -> get_page_from_freelist()
	   -> rmqueue()
	    -> rmqueue_pcplist()
	     -> __rmqueue_pcplist()
	      -> rmqueue_bulk()
	       -> rt_spin_lock()

The rq lock is a raw_spinlock_t. We can't sleep while holding
it. IOW, we can't call alloc_pages() in stack_depot_save_flags().

The task_tick_mm_cid() function with its task_work_add() call was
introduced by commit 223baf9d17f2 ("sched: Fix performance regression
introduced by mm_cid") in v6.4 kernel.

Fortunately, there is a kasan_record_aux_stack_noalloc() variant that
calls stack_depot_save_flags() while not allowing it to allocate
new pages.  To allow task_tick_mm_cid() to use task_work without
page allocation, a new TWAF_NO_ALLOC flag is added to enable calling
kasan_record_aux_stack_noalloc() instead of kasan_record_aux_stack()
if set. The task_tick_mm_cid() function is modified to add this new flag.

The possible downside is the missing stack trace in a KASAN report due
to new page allocation required when task_work_add_noallloc() is called
which should be rare.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/509c29d0d26f68a6f6d0a05cb1a89725237e2b87; https://git.kernel.org/stable/c/73ab05aa46b02d96509cb029a8d04fca7bbde8c7; https://git.kernel.org/stable/c/ce0241ef83eed55f675376e8a3605d23de53d875