rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-53490 
Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-53494 
Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2024-53495 
Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-20T00:00:00.000Z
CVE-2024-53496 
Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2024-53499 
Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2024-53502 
Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-03T00:00:00.000Z
CVE-2024-53504 
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-53505 
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-53506 
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-53507 
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-53522 
Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-53523 
JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-53526 
composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-08T00:00:00.000Z
CVE-2024-53537 
An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53542 
Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-24T00:00:00.000Z
CVE-2024-53543 
NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smarttimeplus/MySQLConnection endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-24T00:00:00.000Z
CVE-2024-53544 
NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the smarttimeplus/MySQLConnection endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-24T00:00:00.000Z
CVE-2024-53552 
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-10T00:00:00.000Z
CVE-2024-53553 
An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-16T00:00:00.000Z
CVE-2024-53554 
A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execute arbitrary code by injecting a malicious payload within the new project details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-25T00:00:00.000Z
CVE-2024-53555 
A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-26T00:00:00.000Z
CVE-2024-53556 
An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /login?next= in the login page URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-25T00:00:00.000Z
CVE-2024-53561 
A remote code execution (RCE) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-14T00:00:00.000Z
CVE-2024-53563 
A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-14T00:00:00.000Z
CVE-2024-53564 
A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Sangoma
product: FreePBX
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 2.2
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Published: 2024-12-02T00:00:00.000Z
CVE-2024-53566 
An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-53568 
A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the tag parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2024-53569 
A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2024-53573 
Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/{id}.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2024-53580 
iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-18T00:00:00.000Z
CVE-2024-53582 
An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53584 
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53586 
An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request. By injecting traversal payloads into the parameter, attackers can manipulate file paths and gain unauthorized access to sensitive files, potentially exposing data outside the intended directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2024-53588 
A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\Downloader\vpn6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-23T00:00:00.000Z
CVE-2024-53589 
GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-53591 
An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2024-53597 
masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-25T00:00:00.000Z
CVE-2024-53599 
A cross-site scripting (XSS) vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-25T00:00:00.000Z
CVE-2024-53603 
A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the contactno POST request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-27T00:00:00.000Z
CVE-2024-53604 
A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the mobnumber POST request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-27T00:00:00.000Z
CVE-2024-53605 
Incorrect access control in the component content://com.handcent.messaging.provider.MessageProvider/ of Handcent NextSMS v10.9.9.7 allows attackers to access sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-53614 
A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-04T00:00:00.000Z
CVE-2024-53615 
A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-30T00:00:00.000Z
CVE-2024-53617 
A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file on behalf of the admin user using IDOR in file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-53619 
An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-26T00:00:00.000Z
CVE-2024-53620 
A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-26T00:00:00.000Z
CVE-2024-53621 
A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-30T00:00:00.000Z
CVE-2024-53623 
Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-53635 
A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the searchdata POST request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-27T00:00:00.000Z
CVE-2024-53636 
An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in the filePath parameter.
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: Serosoft
product: Academia Student Information System
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-04-26T00:00:00.000Z
CVE-2024-53647 
Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests without any restriction, potentially leading to abuse or denial of service.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro ID Security
cpes: cpe:2.3:a:trendmicro:idsecurity:3.0.1778:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2024-12-31T16:14:21.800Z
CVE-2024-53672 Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management Interface
A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking ClearPass Policy Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Daniel Jensen (@dozernz)
Published: 2024-12-03T20:14:36.528Z
CVE-2024-53673 
A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Insight Remote Support
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-11-26T21:45:55.846Z
CVE-2024-53674 
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
Problem types: cwe_id: CWE-91
description: CWE-91 XML Injection (aka Blind XPath Injection)
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Insight Remote Support
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-11-26T21:55:26.013Z
CVE-2024-53675 
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
Problem types: cwe_id: CWE-91
description: CWE-91 XML Injection (aka Blind XPath Injection)
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Insight Remote Support
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-11-26T22:01:12.616Z
CVE-2024-53676 
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Insight Remote Support
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-11-27T00:18:28.527Z
CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new  file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067
Problem types: description: File upload logic is flawed
Affected products: vendor: Apache Software Foundation
product: Apache Struts
default_status: unaffected
Published: 2024-12-11T15:35:43.389Z
CVE-2024-53678 Apache VCL: SQL injection vulnerability in New Block Allocation form
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker.

This issue affects all versions of Apache VCL from 2.2 through 2.5.1.

Users are recommended to upgrade to version 2.5.2, which fixes the issue.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Apache Software Foundation
product: Apache VCL
default_status: unaffected
Credits: lang: en
value: Chiencp and Nothing from TeamTonTac
Published: 2025-03-25T09:33:36.385Z
CVE-2024-53679 Apache VCL: XSS vulnerability in User Lookup impacting user privileges
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevated rights.



This issue affects all versions of Apache VCL through 2.5.1.



Users are recommended to upgrade to version 2.5.2, which fixes the issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache VCL
default_status: unaffected
Credits: lang: en
value: Chiencp and Nothing from TeamTonTac
Published: 2025-03-25T09:33:44.443Z
CVE-2024-53681 nvmet: Don't overflow subsysnqn
In the Linux kernel, the following vulnerability has been resolved:

nvmet: Don't overflow subsysnqn

nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed
size buffer, even though it is dynamically allocated to the size of the
string.

Create a new string with kstrndup instead of using the old buffer.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2025-01-15T13:10:22.141Z
CVE-2024-53682 regulator: axp20x: AXP717: set ramp_delay
In the Linux kernel, the following vulnerability has been resolved:

regulator: axp20x: AXP717: set ramp_delay

AXP717 datasheet says that regulator ramp delay is 15.625 us/step,
which is 10mV in our case.

Add a AXP_DESC_RANGES_DELAY macro and update AXP_DESC_RANGES macro to
expand to AXP_DESC_RANGES_DELAY with ramp_delay = 0

For DCDC4, steps is 100mv

Add a AXP_DESC_DELAY macro and update AXP_DESC macro to
expand to AXP_DESC_DELAY with ramp_delay = 0

This patch fix crashes when using CPU DVFS.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2025-01-11T12:29:49.692Z