deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43988
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in digitalnature Mystique allows Stored XSS.This issue affects Mystique: from n/a through 2.5.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mystique/wordpress-mystique-theme-2-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43991
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in webdzier Hotel Galaxy allows Stored XSS.This issue affects Hotel Galaxy: from n/a through 4.4.24.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/hotel-galaxy/wordpress-hotel-galaxy-theme-4-4-24-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43992
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Latepoint LatePoint allows Stored XSS.This issue affects LatePoint: from n/a through 4.9.91.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/latepoint/wordpress-latepoint-plugin-4-9-91-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43993
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Liquido allows Stored XSS.This issue affects Liquido: from n/a through 1.0.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/liquido/wordpress-liquido-theme-1-0-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43994
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Kahuna allows Stored XSS.This issue affects Kahuna: from n/a through 1.7.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/kahuna/wordpress-kahuna-theme-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43995
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sonalsinha21 Posterity allows Stored XSS.This issue affects Posterity: from n/a through 3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/posterity/wordpress-posterity-theme-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43999
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-8-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44001
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.This issue affects Royal Elementor Addons: from n/a through <= 1.3.982.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-and-templates-plugin-1-3-982-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44002
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase team allows Reflected XSS.This issue affects Team Showcase: from n/a through <= 1.22.25.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/team/vulnerability/wordpress-team-showcase-plugin-1-22-25-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44003
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through <= 1.2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/spice-starter-sites/vulnerability/wordpress-spice-starter-sites-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44005
Published: 2024-09-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 9.3.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-animation-and-page-builder-blocks-plugin-9-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-39068
Published: 2024-09-18
Description: There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacker could use the vulnerability to perform a denial of service attack.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028984
CVE: CVE-2024-45679
Published: 2024-09-18
Description: Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product.
CVSS Score: 8.4 (HIGH)
CWE: CWE-122
References: https://github.com/assimp/assimp/releases/tag/v5.4.3; https://jvn.jp/en/jp/JVN42386607/
CVE: CVE-2024-42404
Published: 2024-09-18
Description: SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN19766555/; https://www.welcart.com/archives/22581.html
CVE: CVE-2024-45366
Published: 2024-09-18
Description: Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN19766555/; https://www.welcart.com/archives/22581.html
CVE: CVE-2024-6641
Published: 2024-09-18
Description: The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration" feature. This makes it possible for unauthenticated attackers to bypass intended security restrictions and expose site usernames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-185, CWE-697
References: https://plugins.trac.wordpress.org/changeset/3151308/wp-security-hardening; https://www.wordfence.com/threat-intel/vulnerabilities/id/7a52a278-1729-4027-8a00-e9804fa6698b?source=cve
CVE: CVE-2024-41929
Published: 2024-09-18
Description: Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://jvn.jp/en/vu/JVNVU90142679/; https://www.takex-eng.co.jp/ja/news/news.php?s=68
CVE: CVE-2024-43778
Published: 2024-09-18
Description: OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU90142679/; https://www.takex-eng.co.jp/ja/news/news.php?s=68
CVE: CVE-2024-46714
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Skip wbscl_set_scaler_filter if filter is null

Callers can pass null in filter (i.e. from returned from the function
wbscl_get_filter_coeffs_16p) and a null check is added to ensure that is
not the case.

This fixes 4 NULL_RETURNS issues reported by Coverity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0364f1f17a86d89dc39040beea4f099e60189f1b; https://git.kernel.org/stable/c/1726914cb17cedab233820d26b86764dc08857b4; https://git.kernel.org/stable/c/54834585e91cab13e9f82d3a811deb212a4df786
CVE: CVE-2024-46715
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

driver: iio: add missing checks on iio_info's callback access

Some callbacks from iio_info structure are accessed without any check, so
if a driver doesn't implement them trying to access the corresponding
sysfs entries produce a kernel oops such as:

[ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute
[...]
[ 2203.783416] Call trace:
[ 2203.783429]  iio_read_channel_info_avail from dev_attr_show+0x18/0x48
[ 2203.789807]  dev_attr_show from sysfs_kf_seq_show+0x90/0x120
[ 2203.794181]  sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4
[ 2203.798555]  seq_read_iter from vfs_read+0x238/0x2a0
[ 2203.802236]  vfs_read from ksys_read+0xa4/0xd4
[ 2203.805385]  ksys_read from ret_fast_syscall+0x0/0x54
[ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0)
[ 2203.812880] dfa0:                   00000003 b6f10f80 00000003 b6eab000 [PII_REDACTED]
[ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 [PII_REDACTED] [PII_REDACTED] 00000000
[ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0
[ 2203.830363] Code: bad PC value
[ 2203.832695] ---[ end trace [PII_REDACTED] ]---
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0cc7e0ee31e5c44904e98e2229d591e093282a70; https://git.kernel.org/stable/c/2b961d5786b4b31c367c719a2f918569b444c007; https://git.kernel.org/stable/c/72f022ebb9deac28663fa4c04ba315ed5d6654d1
CVE: CVE-2024-46716
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor

Remove list_del call in msgdma_chan_desc_cleanup, this should be the role
of msgdma_free_descriptor. In consequence replace list_add_tail with
list_move_tail in msgdma_free_descriptor.

This fixes the path:
   msgdma_free_chan_resources -> msgdma_free_descriptors ->
   msgdma_free_desc_list -> msgdma_free_descriptor

which does not correctly free the descriptors as first nodes were not
removed from the list.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/20bf2920a869f9dbda0ef8c94c87d1901a64a716; https://git.kernel.org/stable/c/54e4ada1a4206f878e345ae01cf37347d803d1b1; https://git.kernel.org/stable/c/a3480e59fdbe5585d2d1eff0bed7671583acf725
CVE: CVE-2024-46717
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: SHAMPO, Fix incorrect page release

Under the following conditions:
1) No skb created yet
2) header_size == 0 (no SHAMPO header)
3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the
   last page fragment of a SHAMPO header page)

a new skb is formed with a page that is NOT a SHAMPO header page (it
is a regular data page). Further down in the same function
(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from
header_index is released. This is wrong and it leads to SHAMPO header
pages being released more than once.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629; https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7; https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab
CVE: CVE-2024-46718
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Don't overmap identity VRAM mapping

Overmapping the identity VRAM mapping is triggering hardware bugs on
certain platforms. Use 2M pages for the last unaligned (to 1G) VRAM
chunk.

v2:
 - Always use 2M pages for last chunk (Fei Yang)
 - break loop when 2M pages are used
 - Add assert for usable_size being 2M aligned
v3:
 - Fix checkpatch
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6d3581edffea0b3a64b0d3094d3f09222e0024f7; https://git.kernel.org/stable/c/bb706e92c87beb9f2543faa1705ccc330b9e7c65
CVE: CVE-2024-46719
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Fix null pointer dereference in trace

ucsi_register_altmode checks IS_ERR for the alt pointer and treats
NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled,
ucsi_register_displayport returns NULL which causes a NULL pointer
dereference in trace. Rather than return NULL, call
typec_port_register_altmode to register DisplayPort alternate mode
as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3aa56313b0de06ce1911950b2cc0c269614a87a9; https://git.kernel.org/stable/c/3b9f2d9301ae67070fe77a0c06758722fd7172b7; https://git.kernel.org/stable/c/7e64cabe81c303bdf6fd26b6a09a3289b33bc870
CVE: CVE-2024-46720
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix dereference after null check

check the pointer hive before use.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/00b9594d6310eb33e14d3f07b54866499efe0d50; https://git.kernel.org/stable/c/0aad97bf6d0bc7a34a19f266b0b9fb2861efe64c; https://git.kernel.org/stable/c/1b73ea3d97cc23f9b16d10021782b48397d2b517
CVE: CVE-2024-46722
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix mc_data out-of-bounds read warning

Clear warning that read mc_data[i-1] may out-of-bounds.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/2097edede72ec5bb3869cf0205337d392fb2a553; https://git.kernel.org/stable/c/310b9d8363b88e818afec97ca7652bd7fe3d0650; https://git.kernel.org/stable/c/345bd3ad387f9e121aaad9c95957b80895e2f2ec
CVE: CVE-2024-46723
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix ucode out-of-bounds read warning

Clear warning that read ucode[] may out-of-bounds.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/0bef65e069d84d1cd77ce757aea0e437b8e2bd33; https://git.kernel.org/stable/c/23fefef859c6057e[PII_REDACTED]bdd938254f8ddd; https://git.kernel.org/stable/c/5f09fa5e0ad45fbca71933a0e024ca52da47d59b
CVE: CVE-2024-46724
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number

Check the fb_channel_number range to avoid the array out-of-bounds
read error
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/32915dc909ff502823babfe07d5416c5b6e8a8b1; https://git.kernel.org/stable/c/45f7b02afc464c208e8f56bcbc672ef5c364c815; https://git.kernel.org/stable/c/725b728cc0c8c5fafdfb51cb0937870d33a40fa4
CVE: CVE-2024-46725
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix out-of-bounds write warning

Check the ring type value to fix the out-of-bounds
write warning
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/130bee397b9cd52006145c87a456fd8719390cb5; https://git.kernel.org/stable/c/919f9bf9997b8dcdc132485ea96121e7d15555f9; https://git.kernel.org/stable/c/a60d1f7ff62e453dde2d3b4907e178954d199844
CVE: CVE-2024-46726
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Ensure index calculation will not overflow

[WHY & HOW]
Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will
never overflow and exceess array size.

This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.kernel.org/stable/c/3dc6bb57dab36b38b7374af0ac916174c146b6ed; https://git.kernel.org/stable/c/733ae185502d30bbe79575167b6178cfb6c5d6bd; https://git.kernel.org/stable/c/8e2734bf444767fed787305ccdcb36a2be5301a2
CVE: CVE-2024-46727
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update

[Why]
Coverity reports NULL_RETURN warning.

[How]
Add otg_master NULL check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/871cd9d881fa791d3f[PII_REDACTED]3de07041c0ae; https://git.kernel.org/stable/c/aad4d3d3d3b6a362bf5db11e1f28c4a60620900d
CVE: CVE-2024-46728
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check index for aux_rd_interval before using

aux_rd_interval has size of 7 and should be checked.

This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/48e0b68e2360b16edf2a0bae05c0051c00fbb48a; https://git.kernel.org/stable/c/6c588e9350dd7a9fb97a56fe74852c9ecc44450c; https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d302e
CVE: CVE-2024-46729
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix incorrect size calculation for loop

[WHY]
fe_clk_en has size of 5 but sizeof(fe_clk_en) has byte size 20 which is
lager than the array size.

[HOW]
Divide byte size 20 by its element size.

This fixes 2 OVERRUN issues reported by Coverity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-131, CWE-787
References: https://git.kernel.org/stable/c/3941a3aa4b653b69876d894d08f3fff1cc965267; https://git.kernel.org/stable/c/712be65b3b372a82bff0865b9c090147764bf1c4
CVE: CVE-2024-46730
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Ensure array index tg_inst won't be -1

[WHY & HOW]
tg_inst will be a negative if timing_generator_count equals 0, which
should be checked before used.

This fixes 2 OVERRUN issues reported by Coverity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://git.kernel.org/stable/c/687fe329f18ab0ab0496b20ed2cb003d4879d931; https://git.kernel.org/stable/c/a64284b9e1999ad5580debced4bc6d6adb28aad4
CVE: CVE-2024-46731
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix the Out-of-bounds read warning

using index i - 1U may beyond element index
for mc_data[] when i = 0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/12c6967428a099bbba9dfd247bb4322a984fcc0b; https://git.kernel.org/stable/c/20c6373a6be93039f9d66029bb1e21038a060be1; https://git.kernel.org/stable/c/3317966efcdc5101e93db21514b68917e7eb34ea
CVE: CVE-2024-46732
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Assign linear_pitch_alignment even for VM

[Description]
Assign linear_pitch_alignment so we don't cause a divide by 0
error in VM environments
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/4bd7710f2fecfc5fb2dda1ca2adc69db8a66b8b6; https://git.kernel.org/stable/c/984debc133efa05e62f5aa1a7a1dd8ca0ef041f4; https://git.kernel.org/stable/c/c44b568931d23aed9d37ecbb31fb5fbdd198bf7b
CVE: CVE-2024-47001
Published: 2024-09-18
Description: Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-912
References: https://jvn.jp/en/vu/JVNVU90142679/; https://www.takex-eng.co.jp/ja/news/news.php?s=68
CVE: CVE-2024-8969
Published: 2024-09-18
Description: OMFLOW from The SYSCOM Group has a vulnerability involving the exposure of sensitive data. This allows remote attackers who have logged into the system to obtain password hashes of all users and administrators.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.twcert.org.tw/en/cp-139-8101-193d8-2.html; https://www.twcert.org.tw/tw/cp-132-8100-f6827-1.html
CVE: CVE-2024-46735
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()

When two UBLK_CMD_START_USER_RECOVERY commands are submitted, the
first one sets 'ubq->ubq_daemon' to NULL, and the second one triggers
WARN in ublk_queue_reinit() and subsequently a NULL pointer dereference
issue.

Fix it by adding the check in ublk_ctrl_start_recovery() and return
immediately in case of zero 'ub->nr_queues_ready'.

  BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
  RIP: 0010:ublk_ctrl_start_recovery.constprop.0+0x82/0x180
  Call Trace:
   <TASK>
   ? __die+0x20/0x70
   ? page_fault_oops+0x75/0x170
   ? exc_page_fault+0x64/0x140
   ? asm_exc_page_fault+0x22/0x30
   ? ublk_ctrl_start_recovery.constprop.0+0x82/0x180
   ublk_ctrl_uring_cmd+0x4f7/0x6c0
   ? pick_next_task_idle+0x26/0x40
   io_uring_cmd+0x9a/0x1b0
   io_issue_sqe+0x193/0x3f0
   io_wq_submit_work+0x9b/0x390
   io_worker_handle_work+0x165/0x360
   io_wq_worker+0xcb/0x2f0
   ? finish_task_switch.isra.0+0x203/0x290
   ? finish_task_switch.isra.0+0x203/0x290
   ? __pfx_io_wq_worker+0x10/0x10
   ret_from_fork+0x2d/0x50
   ? __pfx_io_wq_worker+0x10/0x10
   ret_from_fork_asm+0x1a/0x30
   </TASK>
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/136a29d8112df4ea0a57f9602ddf3579e04089dc; https://git.kernel.org/stable/c/7c890ef60bf417d3fe5c6f7a9f6cef0e1d77f74f; https://git.kernel.org/stable/c/ca249435893dda766f3845c15ca77ca5672022d8
CVE: CVE-2024-46736
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix double put of @cfile in smb2_rename_path()

If smb2_set_path_attr() is called with a valid @cfile and returned
-EINVAL, we need to call cifs_get_writable_path() again as the
reference of @cfile was already dropped by previous smb2_compound_op()
call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/1a46c7f6546b73cbf36f5a618a1a6bbb45391eb3; https://git.kernel.org/stable/c/3523a3df03c6f04f7ea9c2e[PII_REDACTED]e331a4f; https://git.kernel.org/stable/c/b27ea9c96efd2c252a981fb00d0f001b86c90f3e
CVE: CVE-2024-46737
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix kernel crash if commands allocation fails

If the commands allocation fails in nvmet_tcp_alloc_cmds()
the kernel crashes in nvmet_tcp_release_queue_work() because of
a NULL pointer dereference.

  nvmet: failed to install queue 0 cntlid 1 ret 6
  Unable to handle kernel NULL pointer dereference at
         virtual address [PII_REDACTED]

Fix the bug by setting queue->nr_cmds to zero in case
nvmet_tcp_alloc_cmd() fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/03e1fd0327fa5e2174567f5fe9290fe21d21b8f4; https://git.kernel.org/stable/c/489f2913a63f528cfe3f21722583fb981967ecda; https://git.kernel.org/stable/c/50632b877ce55356f5d276b9add289b1e7ddc683