xamxte/cve-to-cwe huggingface dataset:
CVE-2024-4409: The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-5205: The Videojs HTML5 Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videojs_video shortcode in all versions up to, and including, 1.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-4544: The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVE-2024-0867: The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
CVE-2021-47509: In the Linux kernel, the following vulnerability has been resolved:  ALSA: pcm: oss: Limit the period size to 16MB  Set the practical limit to the period size (the fragment shift in OSS) instead of a full 31bit; a too large value could lead to the exhaust of memory as we allocate temporary buffers of the period size, too.  As of this patch, we set to 16MB limit, which should cover all use cases.
CVE-2021-47514: In the Linux kernel, the following vulnerability has been resolved:  devlink: fix netns refcount leak in devlink_nl_cmd_reload()  While preparing my patch series adding netns refcount tracking, I spotted bugs in devlink_nl_cmd_reload()  Some error paths forgot to release a refcount on a netns.  To fix this, we can reduce the scope of get_net()/put_net() section around the call to devlink_reload().
CVE-2021-47530: In the Linux kernel, the following vulnerability has been resolved:  drm/msm: Fix wait_fence submitqueue leak  We weren't dropping the submitqueue reference in all paths.  In particular, when the fence has already been signalled. Split out a helper to simplify handling this in the various different return paths.
CVE-2021-47534: In the Linux kernel, the following vulnerability has been resolved:  drm/vc4: kms: Add missing drm_crtc_commit_put  Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a global state for the HVS, with each FIFO storing the current CRTC commit so that we can properly synchronize commits.  However, the refcounting was off and we thus ended up leaking the drm_crtc_commit structure every commit. Add a drm_crtc_commit_put to prevent the leakage.
CVE-2021-47544: In the Linux kernel, the following vulnerability has been resolved:  tcp: fix page frag corruption on page fault  Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file.  The root cause is quite similar to the one addressed by commit 20eb4f29b602 ("net: fix sk_page_frag() recursion from memory reclaim"). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file.  The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk->sk_allaction for such socket does not prevent the usage for the task_frag, the nested allocation modify "under the hood" the page frag in use by the outer sendmsg call, corrupting the stream.  The overall relevant stack trace looks like the following:  httpd 78268 [001] 3461630.850950:      probe:tcp_sendmsg_locked:         ffffffff91461d91 tcp_sendmsg_locked+0x1         ffffffff91462b57 tcp_sendmsg+0x27         ffffffff9139814e sock_sendmsg+0x3e         ffffffffc06dfe1d smb_send_kvec+0x28         [...]         ffffffffc06cfaf8 cifs_readpages+0x213         ffffffff90e83c4b read_pages+0x6b         ffffffff90e83f31 __do_page_cache_readahead+0x1c1         ffffffff90e79e98 filemap_fault+0x788         ffffffff90eb0458 __do_fault+0x38         ffffffff90eb5280 do_fault+0x1a0         ffffffff90eb7c84 __handle_mm_fault+0x4d4         ffffffff90eb8093 handle_mm_fault+0xc3         ffffffff90c74f6d __do_page_fault+0x1ed         ffffffff90c75277 do_page_fault+0x37         ffffffff9160111e page_fault+0x1e         ffffffff9109e7b5 copyin+0x25         ffffffff9109eb40 _copy_from_iter_full+0xe0         ffffffff91462370 tcp_sendmsg_locked+0x5e0         ffffffff91462370 tcp_sendmsg_locked+0x5e0         ffffffff91462b57 tcp_sendmsg+0x27         ffffffff9139815c sock_sendmsg+0x4c         ffffffff913981f7 sock_write_iter+0x97         ffffffff90f2cc56 do_iter_readv_writev+0x156         ffffffff90f2dff0 do_iter_write+0x80         ffffffff90f2e1c3 vfs_writev+0xa3         ffffffff90f2e27c do_writev+0x5c         ffffffff90c042bb do_syscall_64+0x5b         ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65  The cifs filesystem rightfully sets sk_allocations to GFP_NOFS, we can avoid the nesting using the sk page frag for allocation lacking the __GFP_FS flag. Do not define an additional mm-helper for that, as this is strictly tied to the sk page frag usage.  v1 -> v2:  - use a stricted sk_page_frag() check instead of reordering the    code (Eric)
CVE-2023-52880: In the Linux kernel, the following vulnerability has been resolved:  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc  Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway.  Require initial namespace CAP_NET_ADMIN to do that.
CVE-2024-5218: The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-5150: The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user email. The vulnerability is patched in version 1.7.26, but there is an issue in the patch that causes the entire function to not work, and this issue is fixed in version 1.7.27.
CVE-2024-5204: The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for authenticated attackers with contributor-level and above permissions to log in as any existing user on the site, such as an administrator.
CVE-2024-0434: The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ttbm_new_place_save' function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to create and publish new place posts. This function is also vulnerable to CSRF.
CVE-2024-3050: The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking
CVE-2024-3412: The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2023-52881: In the Linux kernel, the following vulnerability has been resolved:  tcp: do not accept ACK of bytes we never sent  This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow.  ACK seq validation is currently following RFC 5961 5.2 guidelines:     The ACK value is considered acceptable only if    it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=    SND.NXT).  All incoming segments whose ACK value doesn't satisfy the    above condition MUST be discarded and an ACK sent back.  It needs to    be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a    duplicate (SEG.ACK < SND.UNA), it can be ignored.  If the ACK    acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an    ACK, drop the segment, and return".  The "ignored" above implies that    the processing of the incoming data segment continues, which means    the ACK value is treated as acceptable.  This mitigation makes the    ACK check more stringent since any ACK < SND.UNA wouldn't be    accepted, instead only ACKs that are in the range ((SND.UNA -    MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.  This can be refined for new (and possibly spoofed) flows, by not accepting ACK for bytes that were never sent.  This greatly improves TCP security at a little cost.  I added a Fixes: tag to make sure this patch will reach stable trees, even if the 'blamed' patch was adhering to the RFC.  tp->bytes_acked was added in linux-4.2  Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand:  0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1024) = 0  // ---------------- Handshake ------------------- //  // when window scale is set to 14 the window size can be extended to // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet // with ack number in (Server_ISN+1-1073725440. Server_ISN+1) // ,though this ack number acknowledges some data never // sent by the server.  +0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14> +0 > S. 0:0(0) ack 1 <...> +0 < . 1:1(0) ack 1 win 65535 +0 accept(3, ..., ...) = 4  // For the established connection, we send an ACK packet, // the ack packet uses ack number 1 - 1073725300 + 2^32, // where 2^32 is used to wrap around. // Note: we used 1073725300 instead of 1073725440 to avoid possible // edge cases. // 1 - 1073725300 + 2^32 = 3221241997  // Oops, old kernels happily accept this packet. +0 < . 1:1001(1000) ack 3221241997 win 65535  // After the kernel fix the following will be replaced by a challenge ACK, // and prior malicious frame would be dropped. +0 > . 1:1(0) ack 1001
CVE-2024-3726: The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-2253: The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL values the plugin's carousel widgets in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-3269: The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers to uninstall the plugin and delete its data.
CVE-2024-5223: The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-3277: The Yumpu ePaper publishing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 2.0.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload PDF files and publish them, as well as modify the API key.
CVE-2024-4218: The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.7. This is due to plugin improperly releasing the tagged and patched version of the plugin - the vulnerable version is used as the core files, while the patched version was included in a 'trunk' folder. This makes it possible for unauthenticated attackers to perform a variety of actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-4356: The List categories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'categories' shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-2089: The Remote Content Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'remote_content' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-2657: The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVE-2024-4355: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the stopbadbots_get_ajax_data() function in all versions up to, and including, 10.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose visitor data.
CVE-2024-4668: The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Price Table and Post Slider widgets in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-3583: The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-5326: The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
CVE-2024-36017: In the Linux kernel, the following vulnerability has been resolved:  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation  Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read access when accessing the saved (casted) entry in ivvl.
CVE-2024-36880: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: qca: add missing firmware sanity checks  Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer.
CVE-2024-36922: In the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: read txq->read_ptr under lock  If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock.
CVE-2024-36943: In the Linux kernel, the following vulnerability has been resolved:  fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan  make_uffd_wp_pte() was previously doing:    pte = ptep_get(ptep);   ptep_modify_prot_start(ptep);   pte = pte_mkuffd_wp(pte);   ptep_modify_prot_commit(ptep, pte);  But if another thread accessed or dirtied the pte between the first 2 calls, this could lead to loss of that information.  Since ptep_modify_prot_start() gets and clears atomically, the following is the correct pattern and prevents any possible race.  Any access after the first call would see an invalid pte and cause a fault:    pte = ptep_modify_prot_start(ptep);   pte = pte_mkuffd_wp(pte);   ptep_modify_prot_commit(ptep, pte);
CVE-2024-36949: In the Linux kernel, the following vulnerability has been resolved:  amd/amdkfd: sync all devices to wait all processes being evicted  If there are more than one device doing reset in parallel, the first device will call kfd_suspend_all_processes() to evict all processes on all devices, this call takes time to finish. other device will start reset and recover without waiting. if the process has not been evicted before doing recover, it will be restored, then caused page fault.
CVE-2024-36950: In the Linux kernel, the following vulnerability has been resolved:  firewire: ohci: mask bus reset interrupts between ISR and bottom half  In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt.  Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them.  irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally.  This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization.  irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired.  As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be enabled through sysfs in addition to during initial module loading. However, when enabled through sysfs, logging of bus reset interrupts will be effective only starting with the second bus reset, after bus_reset_work has executed.
CVE-2024-36956: In the Linux kernel, the following vulnerability has been resolved:  thermal/debugfs: Free all thermal zone debug memory on zone removal  Because thermal_debug_tz_remove() does not free all memory allocated for thermal zone diagnostics, some of that memory becomes unreachable after freeing the thermal zone's struct thermal_debugfs object.  Address this by making thermal_debug_tz_remove() free all of the memory in question.  Cc :6.8+ <stable@vger.kernel.org> # 6.8+
CVE-2024-36958: In the Linux kernel, the following vulnerability has been resolved:  NFSD: Fix nfsd4_encode_fattr4() crasher  Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().
CVE-2024-36959: In the Linux kernel, the following vulnerability has been resolved:  pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()  If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.
CVE-2024-5345: The Responsive Owl Carousel for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.0 via the layout parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The inclusion is limited to PHP files.