xamxte/cve-to-cwe huggingface dataset:
CVE-2024-26834: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_flow_offload: release dst in case direct xmit path is used  Direct xmit does not use it since it calls dev_queue_xmit() to send packets, hence it calls dst_release().  kmemleak reports:  unreferenced object 0xffff88814f440900 (size 184):   comm "softirq", pid 0, jiffies 4294951896   hex dump (first 32 bytes):     00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff  .`[.............     21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00  !.P.............   backtrace (crc cb2bf5d6):     [<000000003ee17107>] kmem_cache_alloc+0x286/0x340     [<0000000021a5de2c>] dst_alloc+0x43/0xb0     [<00000000f0671159>] rt_dst_alloc+0x2e/0x190     [<00000000fe5092c9>] __mkroute_output+0x244/0x980     [<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160     [<0000000045367433>] nf_ip_route+0xf/0x30     [<0000000085da1d8e>] nf_route+0x2d/0x60     [<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload]     [<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]     [<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables]     [<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables]     [<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables]     [<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160     [<0000000005eccab1>] ip_forward+0x8b6/0x9b0     [<00000000553a269b>] ip_rcv+0x221/0x230     [<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110
CVE-2024-26921: In the Linux kernel, the following vulnerability has been resolved:  inet: inet_defrag: prevent sk release while still in use  ip_local_out() and other functions can pass skb->sk as function argument.  If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released.  This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.  Eric Dumazet made an initial analysis of this bug.  Quoting Eric:   Calling ip_defrag() in output path is also implying skb_orphan(),   which is buggy because output path relies on sk not disappearing.    A relevant old patch about the issue was :   8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")    [..]    net/ipv4/ip_output.c depends on skb->sk being set, and probably to an   inet socket, not an arbitrary one.    If we orphan the packet in ipvlan, then downstream things like FQ   packet scheduler will not work properly.    We need to change ip_defrag() to only use skb_orphan() when really   needed, ie whenever frag_list is going to be used.  Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this:  If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow.  This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered.  This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue.  In the former case, things work as before, skb is orphaned.  This is safe because skb gets queued/stolen and won't continue past reasm engine.  In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.
CVE-2024-4014: The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-7252: The Tickera  WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.
CVE-2023-38299: Various software builds for the AT&T Calypso, Nokia C100, Nokia C200, and BLU View 3 devices leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: AT&T Calypso (ATT/U318AA/U318AA:10/QP1A.190711.020/1632369780:user/release-keys); Nokia C100 (Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_190:user/release-keys and Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_270:user/release-keys); Nokia C200 (Nokia/Drake_02US/DRK:12/SP1A.210812.016/02US_1_080:user/release-keys); and BLU View 3 (BLU/B140DL/B140DL:11/RP1A.200720.011/1628014629:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/1632535579:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/1637325978:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/1650073052:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/1657087912:user/release-keys, BLU/B140DL/B140DL:11/RP1A.200720.011/1666316280:user/release-keys, and BLU/B140DL/B140DL:11/RP1A.200720.011/1672371162:user/release-keys). This malicious app reads from the "persist.sys.imei1" system property to indirectly obtain the device IMEI.
CVE-2024-3293: The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2024-3664: The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author.
CVE-2024-0900: The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress is vulnerable to unauthorized post creation due to a missing capability check on the elespare_create_post() function hooked via AJAX in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary posts.
CVE-2024-3491: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-3929: The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the  Widget Post Overlay block in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-4035: The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.7.7.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-2920: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
CVE-2024-1789: The WP SMTP plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions 1.2 to 1.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2024-3682: The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.
CVE-2024-2838: The WPC Composite Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooco_components[0][name]' parameter in all versions up to, and including, 7.2.7 due to insufficient input sanitization and output escaping and missing authorization on the ajax_save_components function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-3034: The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to traverse directories outside of the context in which the plugin should allow.
CVE-2024-3342: The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in all versions up to, and including, 2.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2024-33851: phpecc, as used in paragonie/phpecc before 2.0.1, has a branch-based timing leak in Point addition. (This is related to phpecc/phpecc on GitHub, and the Matyas Danter ECC library.)
CVE-2022-48631: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0  When walking through an inode extents, the ext4_ext_binsearch_idx() function assumes that the extent header has been previously validated.  However, there are no checks that verify that the number of entries (eh->eh_entries) is non-zero when depth is > 0.  And this will lead to problems because the EXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this:  [  135.245946] ------------[ cut here ]------------ [  135.247579] kernel BUG at fs/ext4/extents.c:2258! [  135.249045] invalid opcode: 0000 [#1] PREEMPT SMP [  135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4 [  135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [  135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0 [  135.256475] Code: [  135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246 [  135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023 [  135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c [  135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c [  135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024 [  135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000 [  135.272394] FS:  00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [  135.274510] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0 [  135.277952] Call Trace: [  135.278635]  <TASK> [  135.279247]  ? preempt_count_add+0x6d/0xa0 [  135.280358]  ? percpu_counter_add_batch+0x55/0xb0 [  135.281612]  ? _raw_read_unlock+0x18/0x30 [  135.282704]  ext4_map_blocks+0x294/0x5a0 [  135.283745]  ? xa_load+0x6f/0xa0 [  135.284562]  ext4_mpage_readpages+0x3d6/0x770 [  135.285646]  read_pages+0x67/0x1d0 [  135.286492]  ? folio_add_lru+0x51/0x80 [  135.287441]  page_cache_ra_unbounded+0x124/0x170 [  135.288510]  filemap_get_pages+0x23d/0x5a0 [  135.289457]  ? path_openat+0xa72/0xdd0 [  135.290332]  filemap_read+0xbf/0x300 [  135.291158]  ? _raw_spin_lock_irqsave+0x17/0x40 [  135.292192]  new_sync_read+0x103/0x170 [  135.293014]  vfs_read+0x15d/0x180 [  135.293745]  ksys_read+0xa1/0xe0 [  135.294461]  do_syscall_64+0x3c/0x80 [  135.295284]  entry_SYSCALL_64_after_hwframe+0x46/0xb0  This patch simply adds an extra check in __ext4_ext_check(), verifying that eh_entries is not 0 when eh_depth is > 0.
CVE-2022-48639: In the Linux kernel, the following vulnerability has been resolved:  net: sched: fix possible refcount leak in tc_new_tfilter()  tfilter_put need to be called to put the refount got by tp->ops->get to avoid possible refcount leak when chain->tmplt_ops != NULL and chain->tmplt_ops != tp->ops.
CVE-2024-2505: The GamiPress  WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical GamiPress  WordPress plugin before 6.8.9 configurations.
CVE-2024-0216: The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE-2024-1371: The LeadConnector plugin for WordPress is vulnerable to unauthorized modification & loss of data due to a missing capability check on the lc_public_api_proxy() function in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to delete arbitrary posts.
CVE-2024-2663: The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $_GET['image'] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE-2024-3072: The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_texts() function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary post title, content, and ACF data.
CVE-2024-4185: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after the account is verified" and "Verify account for current users" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users.
CVE-2020-5200: Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io.
CVE-2024-26938: In the Linux kernel, the following vulnerability has been resolved:  drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()  If we have no VBT, or the VBT didn't declare the encoder in question, we won't have the 'devdata' for the encoder. Instead of oopsing just bail early.  We won't be able to tell whether the port is DP++ or not, but so be it.  (cherry picked from commit 26410896206342c8a80d2b027923e9ee7d33b733)
CVE-2024-26940: In the Linux kernel, the following vulnerability has been resolved:  drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed  The driver creates /sys/kernel/debug/dri/0/mob_ttm even when the corresponding ttm_resource_manager is not allocated. This leads to a crash when trying to read from this file.  Add a check to create mob_ttm, system_mob_ttm, and gmr_ttm debug file only when the corresponding ttm_resource_manager is allocated.  crash> bt PID: 3133409  TASK: ffff8fe4834a5000  CPU: 3    COMMAND: "grep"  #0 [ffffb954506b3b20] machine_kexec at ffffffffb2a6bec3  #1 [ffffb954506b3b78] __crash_kexec at ffffffffb2bb598a  #2 [ffffb954506b3c38] crash_kexec at ffffffffb2bb68c1  #3 [ffffb954506b3c50] oops_end at ffffffffb2a2a9b1  #4 [ffffb954506b3c70] no_context at ffffffffb2a7e913  #5 [ffffb954506b3cc8] __bad_area_nosemaphore at ffffffffb2a7ec8c  #6 [ffffb954506b3d10] do_page_fault at ffffffffb2a7f887  #7 [ffffb954506b3d40] page_fault at ffffffffb360116e     [exception RIP: ttm_resource_manager_debug+0x11]     RIP: ffffffffc04afd11  RSP: ffffb954506b3df0  RFLAGS: 00010246     RAX: ffff8fe41a6d1200  RBX: 0000000000000000  RCX: 0000000000000940     RDX: 0000000000000000  RSI: ffffffffc04b4338  RDI: 0000000000000000     RBP: ffffb954506b3e08   R8: ffff8fee3ffad000   R9: 0000000000000000     R10: ffff8fe41a76a000  R11: 0000000000000001  R12: 00000000ffffffff     R13: 0000000000000001  R14: ffff8fe5bb6f3900  R15: ffff8fe41a6d1200     ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018  #8 [ffffb954506b3e00] ttm_resource_manager_show at ffffffffc04afde7 [ttm]  #9 [ffffb954506b3e30] seq_read at ffffffffb2d8f9f3     RIP: 00007f4c4eda8985  RSP: 00007ffdbba9e9f8  RFLAGS: 00000246     RAX: ffffffffffffffda  RBX: 000000000037e000  RCX: 00007f4c4eda8985     RDX: 000000000037e000  RSI: 00007f4c41573000  RDI: 0000000000000003     RBP: 000000000037e000   R8: 0000000000000000   R9: 000000000037fe30     R10: 0000000000000000  R11: 0000000000000246  R12: 00007f4c41573000     R13: 0000000000000003  R14: 00007f4c41572010  R15: 0000000000000003     ORIG_RAX: 0000000000000000  CS: 0033  SS: 002b
CVE-2024-26977: In the Linux kernel, the following vulnerability has been resolved:  pci_iounmap(): Fix MMIO mapping leak  The #ifdef ARCH_HAS_GENERIC_IOPORT_MAP accidentally also guards iounmap(), which means MMIO mappings are leaked.  Move the guard so we call iounmap() for MMIO mappings.
CVE-2024-26992: In the Linux kernel, the following vulnerability has been resolved:  KVM: x86/pmu: Disable support for adaptive PEBS  Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and because exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak host kernel addresses to the guest.  Bug #1 is that KVM doesn't account for the upper 32 bits of IA32_FIXED_CTR_CTRL when (re)programming fixed counters, e.g fixed_ctrl_field() drops the upper bits, reprogram_fixed_counters() stores local variables as u8s and truncates the upper bits too, etc.  Bug #2 is that, because KVM _always_ sets precise_ip to a non-zero value for PEBS events, perf will _always_ generate an adaptive record, even if the guest requested a basic record.  Note, KVM will also enable adaptive PEBS in individual *counter*, even if adaptive PEBS isn't exposed to the guest, but this is benign as MSR_PEBS_DATA_CFG is guaranteed to be zero, i.e. the guest will only ever see Basic records.  Bug #3 is in perf.  intel_pmu_disable_fixed() doesn't clear the upper bits either, i.e. leaves ICL_FIXED_0_ADAPTIVE set, and intel_pmu_enable_fixed() effectively doesn't clear ICL_FIXED_0_ADAPTIVE either.  I.e. perf _always_ enables ADAPTIVE counters, regardless of what KVM requests.  Bug #4 is that adaptive PEBS *might* effectively bypass event filters set by the host, as "Updated Memory Access Info Group" records information that might be disallowed by userspace via KVM_SET_PMU_EVENT_FILTER.  Bug #5 is that KVM doesn't ensure LBR MSRs hold guest values (or at least zeros) when entering a vCPU with adaptive PEBS, which allows the guest to read host LBRs, i.e. host RIPs/addresses, by enabling "LBR Entries" records.  Disable adaptive PEBS support as an immediate fix due to the severity of the LBR leak in particular, and because fixing all of the bugs will be non-trivial, e.g. not suitable for backporting to stable kernels.  Note!  This will break live migration, but trying to make KVM play nice with live migration would be quite complicated, wouldn't be guaranteed to work (i.e. KVM might still kill/confuse the guest), and it's not clear that there are any publicly available VMMs that support adaptive PEBS, let alone live migrate VMs that support adaptive PEBS, e.g. QEMU doesn't support PEBS in any capacity.
CVE-2024-26993: In the Linux kernel, the following vulnerability has been resolved:  fs: sysfs: Fix reference leak in sysfs_break_active_protection()  The sysfs_break_active_protection() routine has an obvious reference leak in its error path.  If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called).  As a result, the reference to kobj acquired at the start of the function will never be released.  Fix the leak by adding an explicit kobject_put() call when kn is NULL.
CVE-2024-26994: In the Linux kernel, the following vulnerability has been resolved:  speakup: Avoid crash on very long word  In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.