rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-56494 IBM EntireX information disclosure
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209
Affected products: vendor: IBM
product: EntireX
cpes: cpe:2.3:a:ibm:entirex:11.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-02-27T14:47:43.601Z
CVE-2024-56495 IBM EntireX information disclosure
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209
Affected products: vendor: IBM
product: EntireX
cpes: cpe:2.3:a:ibm:entirex:11.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-02-27T14:48:20.148Z
CVE-2024-56496 IBM EntireX information disclosure
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209
Affected products: vendor: IBM
product: EntireX
cpes: cpe:2.3:a:ibm:entirex:11.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-02-27T14:48:33.758Z
CVE-2024-56497 
An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.6 and 6.4.0 through 6.4.7, FortiRecorder versions 7.0.0 and 6.4.0 through 6.4.4 allows attacker to execute unauthorized code or commands via the CLI.
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiMail
cpes: cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiRecorder
cpes: cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X
Published: 2025-01-14T14:09:27.433Z
CVE-2024-56507 Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce
LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting (XSS) vulnerability exists in the LinkAce. This issue occurs in the "URL" field of the "Edit Link" module, where user input is not properly sanitized or encoded before being reflected in the HTML response. This allows attackers to inject and execute arbitrary JavaScript in the context of the victim’s browser, leading to potential session hijacking, data theft, and unauthorized actions. This vulnerability is fixed in 1.15.6.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Kovah
product: LinkAce
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-12-27T15:50:09.784Z
CVE-2024-56508 File Upload Vulnerability Leading to XSS in LinkAce v1.15.5
LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a file upload vulnerability exists in the LinkAce. This issue occurs in the "Import Bookmarks" functionality, where malicious HTML files can be uploaded containing JavaScript payloads. These payloads execute when the uploaded links are accessed, leading to potential reflected or persistent XSS scenarios. This vulnerability is fixed in 1.15.6.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Kovah
product: LinkAce
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
version: 3.1
Published: 2024-12-27T15:52:57.644Z
CVE-2024-56509 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the application can allow attackers to perform local file read (LFR) or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using file:../../../etc/passwd or file: ///etc/passwd can bypass weak validations and allow unauthorized access to sensitive files. Even though this has been addressed in previous patch, it is still insufficient. This vulnerability is fixed in 0.48.05.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: dgtlmoon
product: changedetection.io
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2024-12-27T15:56:04.490Z
CVE-2024-56510 Marp Core allows XSS by improper neutralization of HTML sanitization
@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: marp-team
product: marp-core
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-12-26T20:56:24.743Z
CVE-2024-56511 DataEase has an unauthorized vulnerability
DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to obtain the request URL, and it is passed to the "WhitelistUtils.match" method to determine whether the URL request is an interface that does not require authentication. The "match" method filters semicolons, but this is not enough. When users set "server.servlet.context-path" when deploying products, there is still a risk of being bypassed, which can be bypassed by any whitelist prefix /geo/../context-path/. The vulnerability has been fixed in v2.10.4.
Problem types: cwe_id: CWE-289
description: CWE-289: Authentication Bypass by Alternate Name
Affected products: vendor: dataease
product: dataease
Published: 2025-01-10T15:19:13.173Z
CVE-2024-56512 Apache NiFi: Missing Complete Authorization for Parameter and Service References
Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups.

Creating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter values, the framework did not check user authorization for the bound Parameter Context. Missing authorization for a bound Parameter Context enabled clients to download non-sensitive Parameter values after creating the Process Group.

Creating a new Process Group can also include referencing existing Controller Services or Parameter Providers. The framework did not check user authorization for referenced Controller Services or Parameter Providers, enabling clients to create Process Groups and use these components that were otherwise unauthorized.

This vulnerability is limited in scope to authenticated users authorized to create Process Groups. The scope is further limited to deployments with component-based authorization policies. Upgrading to Apache NiFi 2.1.0 is the recommended mitigation, which includes authorization checking for Parameter and Controller Service references on Process Group creation.
Problem types: cwe_id: CWE-638
description: CWE-638 Not Using Complete Mediation
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
default_status: unaffected
Credits: lang: en
value: Matt Gilman
Published: 2024-12-28T16:18:46.112Z
CVE-2024-56513 Karmada PULL Mode Cluster Privilege Escalation
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the `karmadactl register` command have excessive privileges to access control plane resources. By abusing these permissions, an attacker able to authenticate as the karmada-agent to a karmada cluster would be able to obtain administrative privileges over the entire federation system including all registered member clusters. Since Karmada v1.12.0, command `karmadactl register` restricts the access permissions of pull mode member clusters to control plane resources. This way, an attacker able to authenticate as the karmada-agent cannot control other member clusters in Karmada. As a workaround, one may restrict the access permissions of pull mode member clusters to control plane resources according to Karmada Component Permissions Docs.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
Affected products: vendor: karmada-io
product: karmada
Published: 2025-01-03T16:11:51.629Z
CVE-2024-56514 Karmada Tar Slips in CRDs archive extraction
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTP(s) URL to retrieve the custom resource definitions(CRDs) needed by Karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a TarSlip vulnerability. An attacker able to supply a malicious CRD file into a Karmada initialization could write arbitrary files in arbitrary paths of the filesystem. From Karmada version 1.12.0, when processing custom CRDs files, CRDs archive verification is utilized to enhance file system robustness. A workaround is available. Someone who needs to set flag `--crd` to customize the CRD files required for Karmada initialization when using `karmadactl init` to set up Karmada can manually inspect the CRD files to check whether they contain sequences such as `../` that would alter file paths, to determine if they potentially include malicious files. When using karmada-operator to set up Karmada, one must upgrade one's karmada-operator to one of the fixed versions.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: karmada-io
product: karmada
Published: 2025-01-03T16:15:56.917Z
CVE-2024-56515 Untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: t2bot
product: matrix-media-repo
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-01-16T19:11:02.868Z
CVE-2024-56516 free-one-api uses md5 for password storage
free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no longer considered secure for password storage or transmission. It is vulnerable to collision attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. As of time of publication, a replacement for MD5 has not been committed to the free-one-api GitHub repository.
Problem types: cwe_id: CWE-328
description: CWE-328: Use of Weak Hash
Affected products: vendor: RockChinQ
product: free-one-api
Published: 2024-12-30T16:19:47.571Z
CVE-2024-56517 LGSL has a reflected XSS at /lgsl_files/lgsl_list.php
LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting vulnerability in the `Referer` HTTP header. The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the HTML response without proper sanitization. When crafted malicious input is provided in the `Referer` header, it is echoed back into an HTML attribute in the application’s response. Commit 7ecb839df9358d21f64cdbff5b2536af25a77de1 contains a patch for the issue.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tltneon
product: lgsl
Published: 2024-12-30T16:36:08.785Z
CVE-2024-56518 
Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client configuration file), which can be uploaded at the /cluster-connections URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2024-56519 
An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.
Problem types: description: n/a
Affected products: vendor: tecnick
product: tcpdf
default_status: unaffected
Published: 2024-12-27T00:00:00.000Z
CVE-2024-56520 
An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.
Problem types: description: n/a
Affected products: vendor: tecnick
product: tcpdf
default_status: unaffected
Published: 2024-12-27T00:00:00.000Z
CVE-2024-56521 
An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: tecnick
product: tcpdf
default_status: unaffected
Published: 2024-12-27T00:00:00.000Z
CVE-2024-56522 
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
Problem types: description: n/a
Affected products: vendor: tecnick
product: tcpdf
default_status: unaffected
Published: 2024-12-27T00:00:00.000Z
CVE-2024-56523 
Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request body when using the HTTP GET method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-12T00:00:00.000Z
CVE-2024-56524 
Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special character to the request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-12T00:00:00.000Z
CVE-2024-56525 
In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-24T00:00:00.000Z
CVE-2024-56526 
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2024-56527 
An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: tecnick
product: tcpdf
default_status: unaffected
Published: 2024-12-27T00:00:00.000Z
CVE-2024-56528 
This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending very large payloads to the Collector and can render it unresponsive to the rest of the requests. As a result, data would not enter the pipeline and would be potentially lost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-03T00:00:00.000Z
CVE-2024-56529 
Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on a victim's browser. After a user logs in, they are authenticated and the session identifier is valid. Then, a remote attacker can access the victim's web panel with the same session identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-28T00:00:00.000Z
CVE-2024-56531 ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: Use snd_card_free_when_closed() at disconnection

The USB disconnect callback is supposed to be short and not too-long
waiting.  OTOH, the current code uses snd_card_free() at
disconnection, but this waits for the close of all used fds, hence it
can take long.  It eventually blocks the upper layer USB ioctls, which
may trigger a soft lockup.

An easy workaround is to replace snd_card_free() with
snd_card_free_when_closed().  This variant returns immediately while
the release of resources is done asynchronously by the card device
release at the last close.

This patch also splits the code to the disconnect and the free phases;
the former is called immediately at the USB disconnect callback while
the latter is called from the card destructor.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-12-27T14:11:14.161Z