deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-47069
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry

do_mq_timedreceive calls wq_sleep with a stack local address.  The
sender (do_mq_timedsend) uses this address to later call pipelined_send.

This leads to a very hard to trigger race where a do_mq_timedreceive
call might return and leave do_mq_timedsend to rely on an invalid
address, causing the following crash:

  RIP: 0010:wake_q_add_safe+0x13/0x60
  Call Trace:
   __x64_sys_mq_timedsend+0x2a9/0x490
   do_syscall_64+0x80/0x680
   entry_SYSCALL_64_after_hwframe+0x44/0xa9
  RIP: 0033:0x7f5928e40343

The race occurs as:

1. do_mq_timedreceive calls wq_sleep with the address of `struct
   ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it
   holds a valid `struct ext_wait_queue *` as long as the stack has not
   been overwritten.

2. `ewq_addr` gets added to info->e_wait_q[RECV].list in wq_add, and
   do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call
   __pipelined_op.

3. Sender calls __pipelined_op::smp_store_release(&this->state,
   STATE_READY).  Here is where the race window begins.  (`this` is
   `ewq_addr`.)

4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it
   will see `state == STATE_READY` and break.

5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed
   to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive's
   stack.  (Although the address may not get overwritten until another
   function happens to touch it, which means it can persist around for an
   indefinite time.)

6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a
   `struct ext_wait_queue *`, and uses it to find a task_struct to pass to
   the wake_q_add_safe call.  In the lucky case where nothing has
   overwritten `ewq_addr` yet, `ewq_addr->task` is the right task_struct.
   In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a
   bogus address as the receiver's task_struct causing the crash.

do_mq_timedsend::__pipelined_op() should not dereference `this` after
setting STATE_READY, as the receiver counterpart is now free to return.
Change __pipelined_op to call wake_q_add_safe on the receiver's
task_struct returned by get_task_struct, instead of dereferencing `this`
which sits on the receiver's stack.

As Manfred pointed out, the race potentially also exists in
ipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare.  Fix
those in the same way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-672
References: https://git.kernel.org/stable/c/4528c0c323085e645b8765913b4a7fd42cf49b65; https://git.kernel.org/stable/c/807fa14536b26803b858da878b643be72952a097; https://git.kernel.org/stable/c/a11ddb37bf367e6b5239b95ca759e5389bb46048
CVE: CVE-2021-47070
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

uio_hv_generic: Fix another memory leak in error handling paths

Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe
function is never freed in the error handling path.

Add the missing 'vmbus_free_ring()' call.

Note that it is already freed in the .remove function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0b0226be3a52dadd965644bc52a807961c2c26df; https://git.kernel.org/stable/c/261bbd90cc53d2835343f056770156cf1e82cf03; https://git.kernel.org/stable/c/5f59240cf25b2f7a0fdffc2701482a70310fec07
CVE: CVE-2021-47071
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

uio_hv_generic: Fix a memory leak in error handling paths

If 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be
updated and 'hv_uio_cleanup()' in the error handling path will not be
able to free the corresponding buffer.

In such a case, we need to free the buffer explicitly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3ee098f96b8b6c1a98f7f97915f8873164e6af9d; https://git.kernel.org/stable/c/53486c467e356e06aa37047c984fccd64d78c827; https://git.kernel.org/stable/c/cdd91637d4ef33e2be19a8e16e72e7d00c996d76
CVE: CVE-2021-47073
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios

init_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on systems
where the Dell WMI interface is supported. While exit_dell_smbios_wmi()
unregisters it unconditionally, this leads to the following oops:

[  175.722921] ------------[ cut here ]------------
[  175.722925] Unexpected driver unregister!
[  175.722939] WARNING: CPU: 1 PID: 3630 at drivers/base/driver.c:194 driver_unregister+0x38/0x40
...
[  175.723089] Call Trace:
[  175.723094]  cleanup_module+0x5/0xedd [dell_smbios]
...
[  175.723148] ---[ end trace 064c34e1ad49509d ]---

Make the unregister happen on the same condition the register happens
to fix this.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0cf036a0d325200e6c27b90908e51195bbc557b1; https://git.kernel.org/stable/c/3a53587423d25c87af4b4126a806a0575104b45e; https://git.kernel.org/stable/c/6fa78a6b9a3beb676a010dc489c1257f7e432525
CVE: CVE-2021-47074
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-loop: fix memory leak in nvme_loop_create_ctrl()

When creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl()
fails, the loop ctrl should be freed before jumping to the "out" label.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/03504e3b54cc8118cc26c064e60a0b00c2308708; https://git.kernel.org/stable/c/551ba08d4b7eb26f75758cdb9f15105b276517ad; https://git.kernel.org/stable/c/9c980795ccd77e8abec33dd6fe28dfe1c4083e65
CVE: CVE-2021-47075
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix memory leak in nvmet_alloc_ctrl()

When creating ctrl in nvmet_alloc_ctrl(), if the cntlid_min is larger
than cntlid_max of the subsystem, and jumps to the
"out_free_changed_ns_list" label, but the ctrl->sqs lack of be freed.
Fix this by jumping to the "out_free_sqs" label.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/4720f29acb3fe67aa8aa71e6b675b079d193aaeb; https://git.kernel.org/stable/c/afb680ed7ecbb7fd66ddb43650e9b533fd8b4b9a; https://git.kernel.org/stable/c/fec356a61aa3d3a66416b4321f1279e09e0f256f
CVE: CVE-2021-47076
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Return CQE error if invalid lkey was supplied

RXE is missing update of WQE status in LOCAL_WRITE failures.  This caused
the following kernel panic if someone sent an atomic operation with an
explicitly wrong lkey.

[leonro@vm ~]$ mkt test
test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ...
 WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe]
 Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core
 CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe]
 Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff
 RSP: 0018:ffff8880158af090 EFLAGS: 00010246
 RAX: [PII_REDACTED] RBX: ffff888016a78000 RCX: ffffffffa0cf1652
 RDX: 1ffff9200004b442 RSI: [PII_REDACTED] RDI: ffffc9000025a210
 RBP: dffffc[PII_REDACTED] R08: 00000000ffffffea R09: ffff[PII_REDACTED]0b
 R10: ffffed1002c2ee81 R11: [PII_REDACTED] R12: ffff88800f3b63e8
 R13: ffff888016a78008 R14: ffffc9000025a180 R15:[PII_REDACTED]00000c
 FS:  00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:[PII_REDACTED]
 CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4:[PII_REDACTED]370ea0
 DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
 DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
 Call Trace:
  rxe_do_task+0x130/0x230 [rdma_rxe]
  rxe_rcv+0xb11/0x1df0 [rdma_rxe]
  rxe_loopback+0x157/0x1e0 [rdma_rxe]
  rxe_responder+0x5532/0x7620 [rdma_rxe]
  rxe_do_task+0x130/0x230 [rdma_rxe]
  rxe_rcv+0x9c8/0x1df0 [rdma_rxe]
  rxe_loopback+0x157/0x1e0 [rdma_rxe]
  rxe_requester+0x1efd/0x58c0 [rdma_rxe]
  rxe_do_task+0x130/0x230 [rdma_rxe]
  rxe_post_send+0x998/0x1860 [rdma_rxe]
  ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs]
  ib_uverbs_write+0x847/0xc80 [ib_uverbs]
  vfs_write+0x1c5/0x840
  ksys_write+0x176/0x1d0
  do_syscall_64+0x3f/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/a81e72d49b0648f68ab201163dbfc7841056d7a2; https://git.kernel.org/stable/c/abe31d25facdb9109fe2cf[PII_REDACTED]5291570c; https://git.kernel.org/stable/c/dc07628bd2bbc1da768e265192c28ebd301f509d
CVE: CVE-2021-47077
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qedf: Add pointer checks in qedf_update_link_speed()

The following trace was observed:

 [   14.042059] Call Trace:
 [   14.042061]  <IRQ>
 [   14.042068]  qedf_link_update+0x144/0x1f0 [qedf]
 [   14.042117]  qed_link_update+0x5c/0x80 [qed]
 [   14.042135]  qed_mcp_handle_link_change+0x2d2/0x410 [qed]
 [   14.042155]  ? qed_set_ptt+0x70/0x80 [qed]
 [   14.042170]  ? qed_set_ptt+0x70/0x80 [qed]
 [   14.042186]  ? qed_rd+0x13/0x40 [qed]
 [   14.042205]  qed_mcp_handle_events+0x437/0x690 [qed]
 [   14.042221]  ? qed_set_ptt+0x70/0x80 [qed]
 [   14.042239]  qed_int_sp_dpc+0x3a6/0x3e0 [qed]
 [   14.042245]  tasklet_action_common.isra.14+0x5a/0x100
 [   14.042250]  __do_softirq+0xe4/0x2f8
 [   14.042253]  irq_exit+0xf7/0x100
 [   14.042255]  do_IRQ+0x7f/0xd0
 [   14.042257]  common_interrupt+0xf/0xf
 [   14.042259]  </IRQ>

API qedf_link_update() is getting called from QED but by that time
shost_data is not initialised. This results in a NULL pointer dereference
when we try to dereference shost_data while updating supported_speeds.

Add a NULL pointer check before dereferencing shost_data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/11014efcec378bb0050a6cf08eaf375e3693400a; https://git.kernel.org/stable/c/73578af92a0fae6609b955fcc9113e50e413c80f; https://git.kernel.org/stable/c/a6362a737572f66051deb7637f3f77ddf7a4402f
CVE: CVE-2021-47079
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86: ideapad-laptop: fix a NULL pointer dereference

The third parameter of dytc_cql_command should not be NULL since it will
be dereferenced immediately.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/beab753fe3b4e087411a850a64c6cd748544d8a1; https://git.kernel.org/stable/c/ff67dbd554b2aaa22be933eced32610ff90209dd; https://git.kernel.org/stable/c/beab753fe3b4e087411a850a64c6cd748544d8a1
CVE: CVE-2021-47080
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Prevent divide-by-zero error triggered by the user

The user_entry_size is supplied by the user and later used as a
denominator to calculate number of entries. The zero supplied by the user
will trigger the following divide-by-zero error:

 divide error: 0000 [#1] SMP KASAN PTI
 CPU: 4 PID: 497 Comm: c_repro Not tainted 5.13.0-rc1+ #281
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 RIP: 0010:ib_uverbs_handler_UVERBS_METHOD_QUERY_GID_TABLE+0x1b1/0x510
 Code: 87 59 03 00 00 e8 9f ab 1e ff 48 8d bd a8 00 00 00 e8 d3 70 41 ff 44 0f b7 b5 a8 00 00 00 e8 86 ab 1e ff 31 d2 4c 89 f0 31 ff <49> f7 f5 48 89 d6 48 89 54 24 10 48 89 04 24 e8 1b ad 1e ff 48 8b
 RSP: 0018:ffff88810416f828 EFLAGS: 00010246
 RAX: [PII_REDACTED] RBX: 1ffff1102082df09 RCX: ffffffff82183f3d
 RDX: [PII_REDACTED] RSI: ffff888105f2da00 RDI: [PII_REDACTED]
 RBP: ffff88810416fa98 R08: [PII_REDACTED] R09: ffffed102082df5f
 R10: ffff88810416faf7 R11: ffffed102082df5e R12: [PII_REDACTED]
 R13: [PII_REDACTED] R14: [PII_REDACTED] R15: ffff88810416faf0
 FS:  00007f5715efa740(0000) GS:ffff88811a700000(0000) knlGS:[PII_REDACTED]
 CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
 CR2: [PII_REDACTED] CR3: 000000010c2e0001 CR4:[PII_REDACTED]370ea0
 DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
 DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
 Call Trace:
  ? ib_uverbs_handler_UVERBS_METHOD_INFO_HANDLES+0x4b0/0x4b0
  ib_uverbs_cmd_verbs+0x1546/0x1940
  ib_uverbs_ioctl+0x186/0x240
  __x64_sys_ioctl+0x38a/0x1220
  do_syscall_64+0x3f/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/54d87913f147a983589923c7f651f97de9af5be1; https://git.kernel.org/stable/c/66ab7fcdac34b890017f04f391507ef5b2b89a13; https://git.kernel.org/stable/c/e6871b4270c05f8b212e7d98aee82b357972c80a
CVE: CVE-2021-47081
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memory

Our code analyzer reported a uaf.

In gaudi_memset_device_memory, cb is get via hl_cb_kernel_create()
with 2 refcount.
If hl_cs_allocate_job() failed, the execution runs into release_cb
branch. One ref of cb is dropped by hl_cb_put(cb) and could be freed
if other thread also drops one ref. Then cb is used by cb->id later,
which is a potential uaf.

My patch add a variable 'id' to accept the value of cb->id before the
hl_cb_put(cb) is called, to avoid the potential uaf.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/115726c5d312b462c9d9931ea42becdfa838a076; https://git.kernel.org/stable/c/b49f5af30b0e4064fbd91e83823a4bfcb2c7a3e7; https://git.kernel.org/stable/c/115726c5d312b462c9d9931ea42becdfa838a076
CVE: CVE-2023-49539
Published: 2024-03-01
Description: Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/category. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the category parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49539; https://owasp.org/Top10/A03_2021-Injection/; https://owasp.org/www-community/attacks/xss/
CVE: CVE-2023-49540
Published: 2024-03-01
Description: Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/history. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the history parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49540; https://owasp.org/Top10/A03_2021-Injection/; https://owasp.org/www-community/attacks/xss/
CVE: CVE-2023-49543
Published: 2024-03-01
Description: Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/geraldoalcantara/CVE-2023-49543; https://owasp.org/Top10/A01_2021-Broken_Access_Control/; https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html
CVE: CVE-2023-49544
Published: 2024-03-01
Description: A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customer_support/index.php.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/geraldoalcantara/CVE-2023-49544; https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion; https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
CVE: CVE-2023-49545
Published: 2024-03-01
Description: A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://cwe.mitre.org/data/definitions/548.html; https://github.com/geraldoalcantara/CVE-2023-49545; https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
CVE: CVE-2024-1869
Published: 2024-03-01
Description: Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when using the general-purpose gateway (GGW) over port 9220.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]6033-16/hpsbpi03920; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]6033-16/hpsbpi03920
CVE: CVE-2024-27743
Published: 2024-03-01
Description: Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parameter in the add_invoices.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27743.md; https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27743.md
CVE: CVE-2024-27744
Published: 2024-03-01
Description: Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the profile.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27744.md; https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27744.md
CVE: CVE-2024-27746
Published: 2024-03-01
Description: SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27746.md; https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27746.md
CVE: CVE-2024-27747
Published: 2024-03-01
Description: File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27747.md; https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27747.md
CVE: CVE-2024-24511
Published: 2024-03-01
Description: Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1IhU9tNhc6enKL1Dgq9--R05biJBjodKv/view?usp=sharing; https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-24511%20-%3E%20Stored%20XSS%20in%20input%20Title%20of%20the%20Component; https://drive.google.com/file/d/1IhU9tNhc6enKL1Dgq9--R05biJBjodKv/view?usp=sharing
CVE: CVE-2024-24512
Published: 2024-03-01
Description: Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1jRsltje5PRkgigcY5qLWB3GhF0e9j6aF/view?usp=sharing; https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-24512%20-%3E%20Stored%20XSS%20in%20input%20SubTitle%20of%20the%20Component; https://drive.google.com/file/d/1jRsltje5PRkgigcY5qLWB3GhF0e9j6aF/view?usp=sharing
CVE: CVE-2024-25434
Published: 2024-03-01
Description: A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1MFuAyZukdJeA7HKz8o8pOKLJMjURTZCt/view?usp=sharing; https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-25434%20-%3E%20Stored%20XSS%20in%20input%20public%20name%20of%20the%20Component; https://drive.google.com/file/d/1MFuAyZukdJeA7HKz8o8pOKLJMjURTZCt/view?usp=sharing
CVE: CVE-2024-25436
Published: 2024-03-01
Description: A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1nSC8OlxsEnOajZ2JYuwoKFZqyB764WkL/view?usp=drivesdk; https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-25438%20-%3E%20Stored%20XSS%20in%20input%20Subject%20of%20the%20Add%20Discussion%20Component%20under%20Submissions; https://drive.google.com/file/d/1nSC8OlxsEnOajZ2JYuwoKFZqyB764WkL/view?usp=drivesdk
CVE: CVE-2024-25438
Published: 2024-03-01
Description: A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1-9yUkbsQ-blYpTsdZoXfu3ALBA5wQCbG/view?usp=sharing; https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-25438%20-%3E%20Stored%20XSS%20in%20input%20Subject%20of%20the%20Add%20Discussion%20Component%20under%20Submissions; https://drive.google.com/file/d/1-9yUkbsQ-blYpTsdZoXfu3ALBA5wQCbG/view?usp=sharing
CVE: CVE-2024-27354
Published: 2024-03-01
Description: An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b; https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49; https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html
CVE: CVE-2024-27355
Published: 2024-03-01
Description: An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b; https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129; https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html
CVE: CVE-2024-25063
Published: 2024-03-02
Description: Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker should not have access to.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-professional/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-professional/