xamxte/cve-to-cwe huggingface dataset:
CVE-2024-6599: The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API keys
CVE-2024-6705: The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVE-2023-6708: The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping, even when the 'Sanitize SVG while uploading' feature is enabled. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that successful exploitation of this vulnerability requires the administrator to allow author-level users to upload SVG files.
CVE-2024-5973: The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
CVE-2024-6420: The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
CVE-2024-41015: In the Linux kernel, the following vulnerability has been resolved:  ocfs2: add bounds checking to ocfs2_check_dir_entry()  This adds sanity checks for ocfs2_dir_entry to make sure all members of ocfs2_dir_entry don't stray beyond valid memory region.
CVE-2024-41016: In the Linux kernel, the following vulnerability has been resolved:  ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()  xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested.  It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images.
CVE-2024-41017: In the Linux kernel, the following vulnerability has been resolved:  jfs: don't walk off the end of ealist  Add a check before visiting the members of ea to make sure each ea stays within the ealist.
CVE-2024-41018: In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: Add a check for attr_names and oatbl  Added out-of-bound checking for *ane (ATTR_NAME_ENTRY).
CVE-2024-41026: In the Linux kernel, the following vulnerability has been resolved:  mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length  No check is done on the size of the data to be transmiited. This causes a kernel panic when this size exceeds the sg_miter's length.  Limit the number of transmitted bytes to sgm->length.
CVE-2024-41029: In the Linux kernel, the following vulnerability has been resolved:  nvmem: core: limit cell sysfs permissions to main attribute ones  The cell sysfs attribute should not provide more access to the nvmem data than the main attribute itself. For example if nvme_config::root_only was set, the cell attribute would still provide read access to everybody.  Mask out permissions not available on the main attribute.
CVE-2024-41044: In the Linux kernel, the following vulnerability has been resolved:  ppp: reject claimed-as-LCP but actually malformed packets  Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP packet has an actual body beyond PPP_LCP header bytes, and reject claimed-as-LCP but actually malformed data otherwise.
CVE-2024-41056: In the Linux kernel, the following vulnerability has been resolved:  firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files  Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files.  In V1 wmfw files the name is a NUL-terminated string in a fixed-size array. cs_dsp should protect against overrunning the array if the NUL terminator is missing.
CVE-2024-41062: In the Linux kernel, the following vulnerability has been resolved:  bluetooth/l2cap: sync sock recv cb and release  The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection.             CPU0                       CPU1            ----                       ----            sock_close                 hci_rx_work     l2cap_sock_release         hci_acldata_packet     l2cap_sock_kill            l2cap_recv_frame     sk_free                    l2cap_conless_channel                                l2cap_sock_recv_cb  If hci_rx_work processes the data that needs to be received before the sock is closed, then everything is normal; Otherwise, the work thread may access the released sock when receiving data.  Add a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb.  Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer.
CVE-2024-41064: In the Linux kernel, the following vulnerability has been resolved:  powerpc/eeh: avoid possible crash when edev->pdev changes  If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock while taking a copy of edev->pdev->bus.
CVE-2024-41072: In the Linux kernel, the following vulnerability has been resolved:  wifi: cfg80211: wext: add extra SIOCSIWSCAN data check  In 'cfg80211_wext_siwscan()', add extra check whether number of channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed IW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise.
CVE-2024-41075: In the Linux kernel, the following vulnerability has been resolved:  cachefiles: add consistency check for copen/cread  This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below:    * Generic, copen can only complete open requests, and cread can only     complete read requests.   * For copen, ondemand_id must not be 0, because this indicates that the     request has not been read by the daemon.   * For cread, the object corresponding to fd and req should be the same.
CVE-2024-41081: In the Linux kernel, the following vulnerability has been resolved:  ila: block BH in ila_output()  As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled.  ila_output() is called from lwtunnel_output() possibly from process context, and under rcu_read_lock().  We might be interrupted by a softirq, re-enter ila_output() and corrupt dst_cache data structures.  Fix the race by using local_bh_disable().
CVE-2024-41097: In the Linux kernel, the following vulnerability has been resolved:  usb: atm: cxacru: fix endpoint checking in cxacru_bind()  Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpoints types may be used at urb sumbitting stage which in turn triggers a warning in usb_submit_urb().  Fix the issue by verifying that required endpoint types are present for both in and out endpoints, taking into account cmd endpoint type.  Unfortunately, this patch has not been tested on real hardware.  [1] Syzbot report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 0 PID: 8667 Comm: kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 ... Call Trace:  cxacru_cm+0x3c0/0x8e0 drivers/usb/atm/cxacru.c:649  cxacru_card_status+0x22/0xd0 drivers/usb/atm/cxacru.c:760  cxacru_bind+0x7ac/0x11a0 drivers/usb/atm/cxacru.c:1209  usbatm_usb_probe+0x321/0x1ae0 drivers/usb/atm/usbatm.c:1055  cxacru_usb_probe+0xdf/0x1e0 drivers/usb/atm/cxacru.c:1363  usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396  call_driver_probe drivers/base/dd.c:517 [inline]  really_probe+0x23c/0xcd0 drivers/base/dd.c:595  __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747  driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777  __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894  bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427  __device_attach+0x228/0x4a0 drivers/base/dd.c:965  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487  device_add+0xc2f/0x2180 drivers/base/core.c:3354  usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170  usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238  usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
CVE-2024-42077: In the Linux kernel, the following vulnerability has been resolved:  ocfs2: fix DIO failure due to insufficient transaction credits  The code in ocfs2_dio_end_io_write() estimates number of necessary transaction credits using ocfs2_calc_extend_credits().  This however does not take into account that the IO could be arbitrarily large and can contain arbitrary number of extents.  Extent tree manipulations do often extend the current transaction but not in all of the cases.  For example if we have only single block extents in the tree, ocfs2_mark_extent_written() will end up calling ocfs2_replace_extent_rec() all the time and we will never extend the current transaction and eventually exhaust all the transaction credits if the IO contains many single block extents.  Once that happens a WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to this error.  This was actually triggered by one of our customers on a heavily fragmented OCFS2 filesystem.  To fix the issue make sure the transaction always has enough credits for one extent insert before each call of ocfs2_mark_extent_written().  Heming Zhao said:  ------ PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error"  PID: xxx  TASK: xxxx  CPU: 5  COMMAND: "SubmitThread-CA"   #0 machine_kexec at ffffffff8c069932   #1 __crash_kexec at ffffffff8c1338fa   #2 panic at ffffffff8c1d69b9   #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]   #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]   #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]   #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]   #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]   #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]   #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2] #10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2] #11 dio_complete at ffffffff8c2b9fa7 #12 do_blockdev_direct_IO at ffffffff8c2bc09f #13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2] #14 generic_file_direct_write at ffffffff8c1dcf14 #15 __generic_file_write_iter at ffffffff8c1dd07b #16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2] #17 aio_write at ffffffff8c2cc72e #18 kmem_cache_alloc at ffffffff8c248dde #19 do_io_submit at ffffffff8c2ccada #20 do_syscall_64 at ffffffff8c004984 #21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba
CVE-2024-42098: In the Linux kernel, the following vulnerability has been resolved:  crypto: ecdh - explicitly zeroize private_key  private_key is overwritten with the key parameter passed in by the caller (if present), or alternatively a newly generated private key. However, it is possible that the caller provides a key (or the newly generated key) which is shorter than the previous key. In that scenario, some key material from the previous key would not be overwritten. The easiest solution is to explicitly zeroize the entire private_key array first.  Note that this patch slightly changes the behavior of this function: previously, if the ecc_gen_privkey failed, the old private_key would remain. Now, the private_key is always zeroized. This behavior is consistent with the case where params.key is set and ecc_is_key_valid fails.
CVE-2024-27809: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
CVE-2024-27863: An information disclosure issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. A local attacker may be able to determine kernel memory layout.
CVE-2024-40818: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8, iOS 17.6 and iPadOS 17.6, watchOS 10.6, macOS Sonoma 14.6. An attacker with physical access may be able to use Siri to access sensitive user data.
CVE-2024-1286: The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.
CVE-2024-5807: The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.
CVE-2024-40094: GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
CVE-2024-42109: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_tables: unconditionally flush pending work before notifier  syzbot reports:  KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45 [..] Workqueue: events nf_tables_trans_destroy_work Call Trace:  nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]  nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]  nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597  Problem is that the notifier does a conditional flush, but its possible that the table-to-be-removed is still referenced by transactions being processed by the worker, so we need to flush unconditionally.  We could make the flush_work depend on whether we found a table to delete in nf-next to avoid the flush for most cases.  AFAICS this problem is only exposed in nf-next, with commit e169285f8c56 ("netfilter: nf_tables: do not store nft_ctx in transaction objects"), with this commit applied there is an unconditional fetch of table->family which is whats triggering the above splat.
CVE-2024-42119: In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Skip finding free audio for unknown engine_id  [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio.  [HOW] Skip and return NULL.  This fixes 2 OVERRUN issues reported by Coverity.
CVE-2024-42137: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot  Commit 272970be3dab ("Bluetooth: hci_qca: Fix driver shutdown on closed serdev") will cause below regression issue:  BT can't be enabled after below steps: cold boot -> enable BT -> disable BT -> warm reboot -> BT enable failure if property enable-gpios is not configured within DT|ACPI for QCA6390.  The commit is to fix a use-after-free issue within qca_serdev_shutdown() by adding condition to avoid the serdev is flushed or wrote after closed but also introduces this regression issue regarding above steps since the VSC is not sent to reset controller during warm reboot.  Fixed by sending the VSC to reset controller within qca_serdev_shutdown() once BT was ever enabled, and the use-after-free issue is also fixed by this change since the serdev is still opened before it is flushed or wrote.  Verified by the reported machine Dell XPS 13 9310 laptop over below two kernel commits: commit e00fc2700a3f ("Bluetooth: btusb: Fix triggering coredump implementation for QCA") of bluetooth-next tree. commit b23d98d46d28 ("Bluetooth: btusb: Fix triggering coredump implementation for QCA") of linus mainline tree.
CVE-2024-42142: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: E-switch, Create ingress ACL when needed  Currently, ingress acl is used for three features. It is created only when vport metadata match and prio tag are enabled. But active-backup lag mode also uses it. It is independent of vport metadata match and prio tag. And vport metadata match can be disabled using the following devlink command:   # devlink dev param set pci/0000:08:00.0 name esw_port_metadata \  value false cmode runtime  If ingress acl is not created, will hit panic when creating drop rule for active-backup lag mode. If always create it, there will be about 5% performance degradation.  Fix it by creating ingress acl when needed. If esw_port_metadata is true, ingress acl exists, then create drop rule using existing ingress acl. If esw_port_metadata is false, create ingress acl and then create drop rule.
CVE-2024-42227: In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Fix overlapping copy within dml_core_mode_programming  [WHY] &mode_lib->mp.Watermark and &locals->Watermark are the same address. memcpy may lead to unexpected behavior.  [HOW] memmove should be used.
CVE-2024-41916: A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
CVE-2024-5486: A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager
CVE-2024-41517: An Incorrect Access Control vulnerability in "/admin/benutzer/institution/rechteverwaltung/uebersicht" in Feripro <= v2.2.3 allows remote attackers to get a list of all users and their corresponding privileges.
CVE-2024-6201: HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
CVE-2024-42396: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-42400: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
CVE-2024-34604: Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVE-2024-34605: Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVE-2024-34606: Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVE-2024-34607: Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVE-2024-34608: Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVE-2024-34609: Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.
CVE-2024-34610: Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data.
CVE-2024-34611: Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information.
CVE-2024-34613: Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watch.
CVE-2024-34618: Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information.
CVE-2024-34619: Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
CVE-2024-34620: Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service.
CVE-2024-42233: In the Linux kernel, the following vulnerability has been resolved:  filemap: replace pte_offset_map() with pte_offset_map_nolock()  The vmf->ptl in filemap_fault_recheck_pte_none() is still set from handle_pte_fault().  But at the same time, we did a pte_unmap(vmf->pte).  After a pte_unmap(vmf->pte) unmap and rcu_read_unlock(), the page table may be racily changed and vmf->ptl maybe fails to protect the actual page table.  Fix this by replacing pte_offset_map() with pte_offset_map_nolock().  As David said, the PTL pointer might be stale so if we continue to use it infilemap_fault_recheck_pte_none(), it might trigger UAF.  Also, if the PTL fails, the issue fixed by commit 58f327f2ce80 ("filemap: avoid unnecessary major faults in filemap_fault()") might reappear.
CVE-2024-36446: The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successful exploit could allow an attacker to bypass the authorization schema.
CVE-2024-6460: The Grow by Tradedoubler  WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
CVE-2024-6459: The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
CVE-2024-42261: In the Linux kernel, the following vulnerability has been resolved:  drm/v3d: Validate passed in drm syncobj handles in the timestamp extension  If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well.  Fix it by checking handle was looked up successfully or otherwise fail the extension by jumping into the existing unwind.  (cherry picked from commit 8d1276d1b8f738c3afe1457d4dff5cc66fc848a3)