deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4588
Published: 2023-09-06
Description: File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application's webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server
CVE: CVE-2023-4589
Published: 2023-09-06
Description: Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the update process lacks digital signatures and fails to validate the integrity of the update package, allowing the attacker to inject malicious applications during the update.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-345, CWE-345
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-delinea-secret-server
CVE: CVE-2023-27523
Published: 2023-09-06
Description: Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863
References: https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h; https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h
CVE: CVE-2023-27526
Published: 2023-09-06
Description: A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. 

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://lists.apache.org/thread/ndww89yl2jd98lvn23n9cj722lfdg8dv; https://lists.apache.org/thread/ndww89yl2jd98lvn23n9cj722lfdg8dv
CVE: CVE-2023-36387
Published: 2023-09-06
Description: An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/apache/superset/pull/24185; https://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3; https://github.com/apache/superset/pull/24185
CVE: CVE-2023-36388
Published: 2023-09-06
Description: Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs; https://lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs
CVE: CVE-2023-39264
Published: 2023-09-06
Description: By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75; https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75
CVE: CVE-2023-41149
Published: 2023-09-06
Description: F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN78113802/; https://f-revocrm.jp/2023/08/9394/; http://jvn.jp/en/jp/JVN78113802/
CVE: CVE-2023-41150
Published: 2023-09-06
Description: F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN78113802/; https://f-revocrm.jp/2023/08/9394/; http://jvn.jp/en/jp/JVN78113802/
CVE: CVE-2023-41930
Published: 2023-09-06
Description: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3233; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41931
Published: 2023-09-06
Description: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3233; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41932
Published: 2023-09-06
Description: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41933
Published: 2023-09-06
Description: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41934
Published: 2023-09-06
Description: Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3257; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41935
Published: 2023-09-06
Description: Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3227; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41936
Published: 2023-09-06
Description: Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3228; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41937
Published: 2023-09-06
Description: Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3165; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41938
Published: 2023-09-06
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3093; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41939
Published: 2023-09-06
Description: Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281, CWE-281
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3064; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41940
Published: 2023-09-06
Description: Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control TAP file contents.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3190; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41941
Published: 2023-09-06
Description: A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3101%20(1); http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41942
Published: 2023-09-06
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3101%20(2); http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41943
Published: 2023-09-06
Description: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3101%20(2); http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41944
Published: 2023-09-06
Description: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3102; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41945
Published: 2023-09-06
Description: Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3065; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41946
Published: 2023-09-06
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3082; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2023-41947
Published: 2023-09-06
Description: A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/09/06/9; https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3082; http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE: CVE-2021-21088
Published: 2023-09-06
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-28644
Published: 2023-09-06
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by a Path traversal vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35980
Published: 2023-09-06
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by a Path traversal vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-36021
Published: 2023-09-06
Description: Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system. 
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/magento/apsb21-64.html; https://helpx.adobe.com/security/products/magento/apsb21-64.html
CVE: CVE-2021-36023
Published: 2023-09-06
Description: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/magento/apsb21-64.html; https://helpx.adobe.com/security/products/magento/apsb21-64.html
CVE: CVE-2021-36036
Published: 2023-09-06
Description: Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb21-64.html; https://helpx.adobe.com/security/products/magento/apsb21-64.html
CVE: CVE-2021-36060
Published: 2023-09-06
Description: Adobe Media Encoder version 15.2 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html
CVE: CVE-2021-39859
Published: 2023-09-06
Description: Acrobat Reader DC versions 2[PII_REDACTED]0 (and earlier), 2[PII_REDACTED]6 (and earlier) and 2[PII_REDACTED]9 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-55.html; https://helpx.adobe.com/security/products/acrobat/apsb21-55.html
CVE: CVE-2023-32672
Published: 2023-09-06
Description: An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp; https://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp
CVE: CVE-2023-37941
Published: 2023-09-06
Description: If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.

The Superset metadata db is an 'internal' component that is typically 
only accessible directly by the system administrator and the superset 
process itself. Gaining access to that database should
 be difficult and require significant privileges.

This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html; https://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h; http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
CVE: CVE-2023-39265
Published: 2023-09-06
Description: Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
CVSS Score: 3.8 (LOW)
CWE: CWE-20
References: http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html; https://lists.apache.org/thread/pwdzsdmv4g5g1n2h9m7ortfnxmhr7nfy; http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
CVE: CVE-2023-3777
Published: 2023-09-06
Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.

We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html; http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8
CVE: CVE-2023-4015
Published: 2023-09-06
Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a771f7b266b02d262900c75f1e175c7fe76fec2; https://kernel.dance/0a771f7b266b02d262900c75f1e175c7fe76fec2; https://www.debian.org/security/2023/dsa-5492
CVE: CVE-2023-4206
Published: 2023-09-06
Description: A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.

When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8; https://kernel.dance/b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html