xamxte/cve-to-cwe huggingface dataset:
CVE-2024-34156: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
CVE-2024-39718: An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account.
CVE-2024-36066: The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication (the other option is certificate-based). RFC 4211 section 4.4 requires that password-based MAC parameters use a salt with a random value of at least 8 octets. This helps to inhibit dictionary attacks. Because the standalone CMP client originally was developed as test code, the salt was instead hardcoded and only 6 octets long.
CVE-2024-46679: In the Linux kernel, the following vulnerability has been resolved:  ethtool: check device is present when getting link settings  A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg:       [exception RIP: qed_get_current_link+17]   #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede]   #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3  #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4  #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300  #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c  #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b  #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3  #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1  #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f  #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb   crash> struct net_device.state ffff9a9d21336000     state = 5,  state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10).  This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show").  There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check.  Move this check into ethtool to protect all callers.
CVE-2024-7129: The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
CVE-2024-46704: In the Linux kernel, the following vulnerability has been resolved:  workqueue: Fix spruious data race in __flush_work()  When flushing a work item for cancellation, __flush_work() knows that it exclusively owns the work item through its PENDING bit. 134874e2eee9 ("workqueue: Allow cancel_work_sync() and disable_work() from atomic contexts on BH work items") added a read of @work->data to determine whether to use busy wait for BH work items that are being canceled. While the read is safe when @from_cancel, @work->data was read before testing @from_cancel to simplify code structure:   data = *work_data_bits(work);  if (from_cancel &&      !WARN_ON_ONCE(data & WORK_STRUCT_PWQ) && (data & WORK_OFFQ_BH)) {  While the read data was never used if !@from_cancel, this could trigger KCSAN data race detection spuriously:    ==================================================================   BUG: KCSAN: data-race in __flush_work / __flush_work    write to 0xffff8881223aa3e8 of 8 bytes by task 3998 on cpu 0:    instrument_write include/linux/instrumented.h:41 [inline]    ___set_bit include/asm-generic/bitops/instrumented-non-atomic.h:28 [inline]    insert_wq_barrier kernel/workqueue.c:3790 [inline]    start_flush_work kernel/workqueue.c:4142 [inline]    __flush_work+0x30b/0x570 kernel/workqueue.c:4178    flush_work kernel/workqueue.c:4229 [inline]    ...    read to 0xffff8881223aa3e8 of 8 bytes by task 50 on cpu 1:    __flush_work+0x42a/0x570 kernel/workqueue.c:4188    flush_work kernel/workqueue.c:4229 [inline]    flush_delayed_work+0x66/0x70 kernel/workqueue.c:4251    ...    value changed: 0x0000000000400000 -> 0xffff88810006c00d  Reorganize the code so that @from_cancel is tested before @work->data is accessed. The only problem is triggering KCSAN detection spuriously. This shouldn't need READ_ONCE() or other access qualifiers.  No functional changes.
CVE-2024-46710: In the Linux kernel, the following vulnerability has been resolved:  drm/vmwgfx: Prevent unmapping active read buffers  The kms paths keep a persistent map active to read and compare the cursor buffer. These maps can race with each other in simple scenario where: a) buffer "a" mapped for update b) buffer "a" mapped for compare c) do the compare d) unmap "a" for compare e) update the cursor f) unmap "a" for update At step "e" the buffer has been unmapped and the read contents is bogus.  Prevent unmapping of active read buffers by simply keeping a count of how many paths have currently active maps and unmap only when the count reaches 0.
CVE-2024-46958: In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.
CVE-2024-40826: A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An unencrypted document may be written to a temporary file when using print preview.
CVE-2024-40830: This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to enumerate a user's installed apps.
CVE-2024-40866: The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.
CVE-2024-44177: A privacy issue was addressed by removing sensitive data. This issue is fixed in macOS Ventura 13.7, macOS Sonoma 14.7, macOS Sequoia 15. An app may be able to access user-sensitive data.
CVE-2024-8906: Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-46717: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: SHAMPO, Fix incorrect page release  Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the    last page fragment of a SHAMPO header page)  a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once.
CVE-2024-46728: In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Check index for aux_rd_interval before using  aux_rd_interval has size of 7 and should be checked.  This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.
CVE-2024-46751: In the Linux kernel, the following vulnerability has been resolved:  btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()  Instead of doing a BUG_ON() handle the error by returning -EUCLEAN, aborting the transaction and logging an error message.
CVE-2024-46767: In the Linux kernel, the following vulnerability has been resolved:  net: phy: Fix missing of_node_put() for leds  The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it.
CVE-2024-46775: In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Validate function returns  [WHAT & HOW] Function return values must be checked before data can be used in subsequent functions.  This fixes 4 CHECKED_RETURN issues reported by Coverity.
CVE-2024-46780: In the Linux kernel, the following vulnerability has been resolved:  nilfs2: protect references to superblock parameters exposed in sysfs  The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues.  So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem".  Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it.
CVE-2024-46783: In the Linux kernel, the following vulnerability has been resolved:  tcp_bpf: fix return value of tcp_bpf_sendmsg()  When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes negative at least in the following case:  468         case __SK_DROP: 469         default: 470                 sk_msg_free_partial(sk, msg, tosend); 471                 sk_msg_apply_bytes(psock, tosend); 472                 *copied -= (tosend + delta); // <==== HERE 473                 return -EACCES;  Therefore, it could lead to the following BUG with a proper value of 'copied' (thanks to syzbot). We should not use negative 'copied' as a return value here.    ------------[ cut here ]------------   kernel BUG at net/socket.c:733!   Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP   Modules linked in:   CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0   Hardware name: linux,dummy-virt (DT)   pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)   pc : sock_sendmsg_nosec net/socket.c:733 [inline]   pc : sock_sendmsg_nosec net/socket.c:728 [inline]   pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745   lr : sock_sendmsg_nosec net/socket.c:730 [inline]   lr : __sock_sendmsg+0x54/0x60 net/socket.c:745   sp : ffff800088ea3b30   x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000   x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000   x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90   x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001   x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf   x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000   x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0   x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000   x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900   x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef   Call trace:    sock_sendmsg_nosec net/socket.c:733 [inline]    __sock_sendmsg+0x5c/0x60 net/socket.c:745    ____sys_sendmsg+0x274/0x2ac net/socket.c:2597    ___sys_sendmsg+0xac/0x100 net/socket.c:2651    __sys_sendmsg+0x84/0xe0 net/socket.c:2680    __do_sys_sendmsg net/socket.c:2689 [inline]    __se_sys_sendmsg net/socket.c:2687 [inline]    __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687    __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]    invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49    el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132    do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151    el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712    el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730    el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598   Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000)   ---[ end trace 0000000000000000 ]---
CVE-2024-46792: In the Linux kernel, the following vulnerability has been resolved:  riscv: misaligned: Restrict user access to kernel memory  raw_copy_{to,from}_user() do not call access_ok(), so this code allowed userspace to access any virtual memory address.
CVE-2024-46794: In the Linux kernel, the following vulnerability has been resolved:  x86/tdx: Fix data leak in mmio_read()  The mmio_read() function makes a TDVMCALL to retrieve MMIO data for an address from the VMM.  Sean noticed that mmio_read() unintentionally exposes the value of an initialized variable (val) on the stack to the VMM.  This variable is only needed as an output value. It did not need to be passed to the VMM in the first place.  Do not send the original value of *val to the VMM.  [ dhansen: clarify what 'val' is used for. ]
CVE-2024-46801: In the Linux kernel, the following vulnerability has been resolved:  libfs: fix get_stashed_dentry()  get_stashed_dentry() tries to optimistically retrieve a stashed dentry from a provided location.  It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues.  Use rcu_dereference() instead of READ_ONCE() it's effectively equivalent with some lockdep bells and whistles and it communicates clearly that this expects rcu protection.
CVE-2024-47220: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."
CVE-2022-48945: In the Linux kernel, the following vulnerability has been resolved:  media: vivid: fix compose size exceed boundary  syzkaller found a bug:   BUG: unable to handle page fault for address: ffffc9000a3b1000  #PF: supervisor write access in kernel mode  #PF: error_code(0x0002) - not-present page  PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0  Oops: 0002 [#1] PREEMPT SMP  CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014  RIP: 0010:memcpy_erms+0x6/0x10 [...]  Call Trace:   <TASK>   ? tpg_fill_plane_buffer+0x856/0x15b0   vivid_fillbuff+0x8ac/0x1110   vivid_thread_vid_cap_tick+0x361/0xc90   vivid_thread_vid_cap+0x21a/0x3a0   kthread+0x143/0x180   ret_from_fork+0x1f/0x30   </TASK>  This is because we forget to check boundary after adjust compose->height int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem for this case.
CVE-2024-42861: An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message to the time synchronization function
CVE-2024-46935: Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash the workspace due to an issue in the message parser.
CVE-2024-7714: The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and  'ays_chatgpt_save_feedback'
CVE-2024-46815: In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]  [WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].  This fixes an OVERRUN issue reported by Coverity.
CVE-2024-46823: In the Linux kernel, the following vulnerability has been resolved:  kunit/overflow: Fix UB in overflow_allocation_test  The 'device_name' array doesn't exist out of the 'overflow_allocation_test' function scope. However, it is being used as a driver name when calling 'kunit_driver_create' from 'kunit_device_register'. It produces the kernel panic with KASAN enabled.  Since this variable is used in one place only, remove it and pass the device name into kunit_device_register directly as an ascii string.
CVE-2024-46827: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix firmware crash due to invalid peer nss  Currently, if the access point receives an association request containing an Extended HE Capabilities Information Element with an invalid MCS-NSS, it triggers a firmware crash.  This issue arises when EHT-PHY capabilities shows support for a bandwidth and MCS-NSS set for that particular bandwidth is filled by zeros and due to this, driver obtains peer_nss as 0 and sending this value to firmware causes crash.  Address this issue by implementing a validation step for the peer_nss value before passing it to the firmware. If the value is greater than zero, proceed with forwarding it to the firmware. However, if the value is invalid, reject the association request to prevent potential firmware crashes.  Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
CVE-2024-46828: In the Linux kernel, the following vulnerability has been resolved:  sched: sch_cake: fix bulk flow accounting logic for host fairness  In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when iterating through flows. The count of active bulk flows is updated whenever a flow changes state.  This has a peculiar interaction with the hash collision handling: when a hash collision occurs (after the set-associative hashing), the state of the hash bucket is simply updated to match the new packet that collided, and if host fairness is enabled, that also means assigning new per-host state to the flow. For this reason, the bulk flow counters of the host(s) assigned to the flow are decremented, before new state is assigned (and the counters, which may not belong to the same host anymore, are incremented again).  Back when this code was introduced, the host fairness mode was always enabled, so the decrement was unconditional. When the configuration flags were introduced the *increment* was made conditional, but the *decrement* was not. Which of course can lead to a spurious decrement (and associated wrap-around to U16_MAX).  AFAICT, when host fairness is disabled, the decrement and wrap-around happens as soon as a hash collision occurs (which is not that common in itself, due to the set-associative hashing). However, in most cases this is harmless, as the value is only used when host fairness mode is enabled. So in order to trigger an array overflow, sch_cake has to first be configured with host fairness disabled, and while running in this mode, a hash collision has to occur to cause the overflow. Then, the qdisc has to be reconfigured to enable host fairness, which leads to the array out-of-bounds because the wrapped-around value is retained and used as an array index. It seems that syzbot managed to trigger this, which is quite impressive in its own right.  This patch fixes the issue by introducing the same conditional check on decrement as is used on increment.  The original bug predates the upstreaming of cake, but the commit listed in the Fixes tag touched that code, meaning that this patch won't apply before that.
CVE-2024-46830: In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS  Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory.  Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU.  I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems.  Acquiring SRCU isn't all that expensive, so for simplicity, grab it unconditionally for KVM_SET_VCPU_EVENTS.   =============================  WARNING: suspicious RCU usage  6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted  -----------------------------  include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage!   other info that might help us debug this:   rcu_scheduler_active = 2, debug_locks = 1  1 lock held by repro/1071:   #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm]   stack backtrace:  CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015  Call Trace:   <TASK>   dump_stack_lvl+0x7f/0x90   lockdep_rcu_suspicious+0x13f/0x1a0   kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm]   kvm_vcpu_read_guest+0x3e/0x90 [kvm]   nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel]   load_vmcs12_host_state+0x432/0xb40 [kvm_intel]   vmx_leave_nested+0x30/0x40 [kvm_intel]   kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm]   kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm]   ? mark_held_locks+0x49/0x70   ? kvm_vcpu_ioctl+0x7d/0x970 [kvm]   ? kvm_vcpu_ioctl+0x497/0x970 [kvm]   kvm_vcpu_ioctl+0x497/0x970 [kvm]   ? lock_acquire+0xba/0x2d0   ? find_held_lock+0x2b/0x80   ? do_user_addr_fault+0x40c/0x6f0   ? lock_release+0xb7/0x270   __x64_sys_ioctl+0x82/0xb0   do_syscall_64+0x6c/0x170   entry_SYSCALL_64_after_hwframe+0x4b/0x53  RIP: 0033:0x7ff11eb1b539   </TASK>
CVE-2024-46837: In the Linux kernel, the following vulnerability has been resolved:  drm/panthor: Restrict high priorities on group_create  We were allowing any users to create a high priority group without any permission checks. As a result, this was allowing possible denial of service.  We now only allow the DRM master or users with the CAP_SYS_NICE capability to set higher priorities than PANTHOR_GROUP_PRIORITY_MEDIUM.  As the sole user of that uAPI lives in Mesa and hardcode a value of MEDIUM [1], this should be safe to do.  Additionally, as those checks are performed at the ioctl level, panthor_group_create now only check for priority level validity.  [1]https://gitlab.freedesktop.org/mesa/mesa/-/blob/f390835074bdf162a63deb0311d1a6de527f9f89/src/gallium/drivers/panfrost/pan_csf.c#L1038
CVE-2024-46854: In the Linux kernel, the following vulnerability has been resolved:  net: dpaa: Pad packets to ETH_ZLEN  When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running   $ ping -s 11 destination
CVE-2024-46855: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_socket: fix sk refcount leaks  We must put 'sk' reference before returning.
CVE-2024-45773: A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.
CVE-2024-45863: A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00.
CVE-2024-46869: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: btintel_pcie: Allocate memory for driver private data  Fix driver not allocating memory for struct btintel_data which is used to store internal data.
CVE-2024-9395: A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131.
CVE-2024-9313: Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.
CVE-2024-44204: A logic issue was addressed with improved validation. This issue is fixed in iOS 18.0.1 and iPadOS 18.0.1. A user's saved passwords may be read aloud by VoiceOver.