yahoo-inc/cve-impacts huggingface dataset:
CVE-2024-26752: In the Linux kernel, the following vulnerability has been resolved:l2tp: pass correct message length to ip6_append_datal2tp_ip6_sendmsg needs to avoid accounting for the transport headertwice when splicing more data into an already partially-occupied skbuff.To manage this, we check whether the skbuff contains data usingskb_queue_empty when deciding how much data to append usingip6_append_data.However, the code which performed the calculation was incorrect:     ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;...due to C operator precedence, this ends up setting ulen totranshdrlen for messages with a non-zero length, which results incorrupted packets on the wire.Add parentheses to correct the calculation in line with the originalintent.
CVE-2024-26753: In the Linux kernel, the following vulnerability has been resolved:crypto: virtio/akcipher - Fix stack overflow on memcpysizeof(struct virtio_crypto_akcipher_session_para) is less thansizeof(struct virtio_crypto_op_ctrl_req::u), copying more bytes fromstack variable leads stack overflow. Clang reports this issue bycommands:make -j CC=clang-14 mrproper >/dev/null 2>&1make -j O=/tmp/crypto-build CC=clang-14 allmodconfig >/dev/null 2>&1make -j O=/tmp/crypto-build W=1 CC=clang-14 drivers/crypto/virtio/  virtio_crypto_akcipher_algs.o
Key phrases: stack overflow
CVE-2024-26754: In the Linux kernel, the following vulnerability has been resolved:gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()The gtp_net_ops pernet operations structure for the subsystem must beregistered before registering the generic netlink family.Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug:general protection fault, probably for non-canonical address0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTIKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]CPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014RIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]Code: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74RSP: 0018:ffff888014107220 EFLAGS: 00010202RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000R13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000FS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0PKRU: 55555554Call Trace: <TASK> ? show_regs+0x90/0xa0 ? die_addr+0x50/0xd0 ? exc_general_protection+0x148/0x220 ? asm_exc_general_protection+0x22/0x30 ? gtp_genl_dump_pdp+0x1be/0x800 [gtp] ? __alloc_skb+0x1dd/0x350 ? __pfx___alloc_skb+0x10/0x10 genl_dumpit+0x11d/0x230 netlink_dump+0x5b9/0xce0 ? lockdep_hardirqs_on_prepare+0x253/0x430 ? __pfx_netlink_dump+0x10/0x10 ? kasan_save_track+0x10/0x40 ? __kasan_kmalloc+0x9b/0xa0 ? genl_start+0x675/0x970 __netlink_dump_start+0x6fc/0x9f0 genl_family_rcv_msg_dumpit+0x1bb/0x2d0 ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 ? genl_op_from_small+0x2a/0x440 ? cap_capable+0x1d0/0x240 ? __pfx_genl_start+0x10/0x10 ? __pfx_genl_dumpit+0x10/0x10 ? __pfx_genl_done+0x10/0x10 ? security_capable+0x9d/0xe0
Key phrases: use after free
CVE-2024-26755: In the Linux kernel, the following vulnerability has been resolved:md: Don't suspend the array for interrupted reshapemd_start_sync() will suspend the array if there are spares that can beadded or removed from conf, however, if reshape is still in progress,this won't happen at all or data will be corrupted(remove_and_add_spareswon't be called from md_choose_sync_action for reshape), hence there isno need to suspend the array if reshape is not done yet.Meanwhile, there is a potential deadlock for raid456:1) reshape is interrupted;2) set one of the disk WantReplacement, and add a new disk to the array,   however, recovery won't start until the reshape is finished;3) then issue an IO across reshpae position, this IO will wait for   reshape to make progress;4) continue to reshape, then md_start_sync() found there is a spare disk   that can be added to conf, mddev_suspend() is called;Step 4 and step 3 is waiting for each other, deadlock triggered. Notedthis problem is found by code review, and it's not reporduced yet.Fix this porblem by don't suspend the array for interrupted reshape,this is safe because conf won't be changed until reshape is done.
CVE-2024-26756: In the Linux kernel, the following vulnerability has been resolved:md: Don't register sync_thread for reshape directlyCurrently, if reshape is interrupted, then reassemble the array willregister sync_thread directly from pers->run(), in this case'MD_RECOVERY_RUNNING' is set directly, however, there is no guaranteethat md_do_sync() will be executed, hence stop_sync_thread() will hangbecause 'MD_RECOVERY_RUNNING' can't be cleared.Last patch make sure that md_do_sync() will set MD_RECOVERY_DONE,however, following hang can still be triggered by dm-raid testshell/lvconvert-raid-reshape.sh occasionally:[root@fedora ~]# cat /proc/1982/stack[<0>] stop_sync_thread+0x1ab/0x270 [md_mod][<0>] md_frozen_sync_thread+0x5c/0xa0 [md_mod][<0>] raid_presuspend+0x1e/0x70 [dm_raid][<0>] dm_table_presuspend_targets+0x40/0xb0 [dm_mod][<0>] __dm_destroy+0x2a5/0x310 [dm_mod][<0>] dm_destroy+0x16/0x30 [dm_mod][<0>] dev_remove+0x165/0x290 [dm_mod][<0>] ctl_ioctl+0x4bb/0x7b0 [dm_mod][<0>] dm_ctl_ioctl+0x11/0x20 [dm_mod][<0>] vfs_ioctl+0x21/0x60[<0>] __x64_sys_ioctl+0xb9/0xe0[<0>] do_syscall_64+0xc6/0x230[<0>] entry_SYSCALL_64_after_hwframe+0x6c/0x74Meanwhile mddev->recovery is:MD_RECOVERY_RUNNING |MD_RECOVERY_INTR |MD_RECOVERY_RESHAPE |MD_RECOVERY_FROZENFix this problem by remove the code to register sync_thread directlyfrom raid10 and raid5. And let md_check_recovery() to registersync_thread.
Key phrases: hang
CVE-2024-26757: In the Linux kernel, the following vulnerability has been resolved:md: Don't ignore read-only array in md_check_recovery()Usually if the array is not read-write, md_check_recovery() won'tregister new sync_thread in the first place. And if the array isread-write and sync_thread is registered, md_set_readonly() willunregister sync_thread before setting the array read-only. md/raidfollow this behavior hence there is no problem.After commit f52f5c71f3d4 ("md: fix stopping sync thread"), followinghang can be triggered by test shell/integrity-caching.sh:1) array is read-only. dm-raid update super block:rs_update_sbs ro = mddev->ro mddev->ro = 0  -> set array read-write md_update_sb2) register new sync thread concurrently.3) dm-raid set array back to read-only:rs_update_sbs mddev->ro = ro4) stop the array:raid_dtr md_stop  stop_sync_thread    set_bit(MD_RECOVERY_INTR, &mddev->recovery);    md_wakeup_thread_directly(mddev->sync_thread);    wait_event(..., !test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))5) sync thread done: md_do_sync set_bit(MD_RECOVERY_DONE, &mddev->recovery); md_wakeup_thread(mddev->thread);6) daemon thread can't unregister sync thread: md_check_recovery  if (!md_is_rdwr(mddev) &&      !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))   return;  -> -> MD_RECOVERY_RUNNING can't be cleared, hence step 4 hang;The root cause is that dm-raid manipulate 'mddev->ro' by itself,however, dm-raid really should stop sync thread before setting thearray read-only. Unfortunately, I need to read more code before Ican refacter the handler of 'mddev->ro' in dm-raid, hence let's fixthe problem the easy way for now to prevent dm-raid regression.
CVE-2024-26758: In the Linux kernel, the following vulnerability has been resolved:md: Don't ignore suspended array in md_check_recovery()mddev_suspend() never stop sync_thread, hence it doesn't make sense toignore suspended array in md_check_recovery(), which might causesync_thread can't be unregistered.After commit f52f5c71f3d4 ("md: fix stopping sync thread"), followinghang can be triggered by test shell/integrity-caching.sh:1) suspend the array:raid_postsuspend mddev_suspend2) stop the array:raid_dtr md_stop  __md_stop_writes   stop_sync_thread    set_bit(MD_RECOVERY_INTR, &mddev->recovery);    md_wakeup_thread_directly(mddev->sync_thread);    wait_event(..., !test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))3) sync thread done:md_do_sync set_bit(MD_RECOVERY_DONE, &mddev->recovery); md_wakeup_thread(mddev->thread);4) daemon thread can't unregister sync thread:md_check_recovery if (mddev->suspended)   return; -> return directly md_read_sync_thread clear_bit(MD_RECOVERY_RUNNING, &mddev->recovery); -> MD_RECOVERY_RUNNING can't be cleared, hence step 2 hang;This problem is not just related to dm-raid, fix it by ignoringsuspended array in md_check_recovery(). And follow up patches willimprove dm-raid better to frozen sync thread during suspend.
CVE-2024-2676: A vulnerability, which was classified as critical, was found in Campcodes Online Job Finder System 1.0. Affected is an unknown function of the file /admin/company/controller.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257376.
Key phrases: sql injection
CVE-2024-26760: In the Linux kernel, the following vulnerability has been resolved:scsi: target: pscsi: Fix bio_put() for error caseAs of commit 066ff571011d ("block: turn bio_kmalloc into a simple kmallocwrapper"), a bio allocated by bio_kmalloc() must be freed by bio_uninit()and kfree(). That is not done properly for the error case, hitting WARN andNULL pointer dereference in bio_free().
CVE-2024-26761: In the Linux kernel, the following vulnerability has been resolved:cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS windowThe Linux CXL subsystem is built on the assumption that HPA == SPA.That is, the host physical address (HPA) the HDM decoder registers areprogrammed with are system physical addresses (SPA).During HDM decoder setup, the DVSEC CXL range registers (cxl-3.1,8.1.3.8) are checked if the memory is enabled and the CXL range is ina HPA window that is described in a CFMWS structure of the CXL hostbridge (cxl-3.1, 9.18.1.3).Now, if the HPA is not an SPA, the CXL range does not match a CFMWSwindow and the CXL memory range will be disabled then. The HDM decoderstops working which causes system memory being disabled and further asystem hang during HDM decoder initialization, typically when a CXLenabled kernel boots.Prevent a system hang and do not disable the HDM decoder if thedecoder's CXL range is not found in a CFMWS window.Note the change only fixes a hardware hang, but does not implementHPA/SPA translation. Support for this can be added in a follow onpatch series.
Key phrases: hang
CVE-2024-26762: In the Linux kernel, the following vulnerability has been resolved:cxl/pci: Skip to handle RAS errors if CXL.mem device is detachedThe PCI AER model is an awkward fit for CXL error handling. While theexpectation is that a PCI device can escalate to link reset to recoverfrom an AER event, the same reset on CXL amounts to a surprise memoryhotplug of massive amounts of memory.At present, the CXL error handler attempts some optimistic errorhandling to unbind the device from the cxl_mem driver after reaping someRAS register values. This results in a "hopeful" attempt to unplug thememory, but there is no guarantee that will succeed.A subsequent AER notification after the memdev unbind event can nolonger assume the registers are mapped. Check for memdev bind beforereaping status register values to avoid crashes of the form: BUG: unable to handle page fault for address: ffa00000195e9100 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core] [...] Call Trace:  <TASK>  ? __die+0x24/0x70  ? page_fault_oops+0x82/0x160  ? kernelmode_fixup_or_oops+0x84/0x110  ? exc_page_fault+0x113/0x170  ? asm_exc_page_fault+0x26/0x30  ? __pfx_dpc_reset_link+0x10/0x10  ? __cxl_handle_ras+0x30/0x110 [cxl_core]  ? find_cxl_port+0x59/0x80 [cxl_core]  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]  cxl_error_detected+0x6c/0xf0 [cxl_core]  report_error_detected+0xc7/0x1c0  pci_walk_bus+0x73/0x90  pcie_do_recovery+0x23f/0x330Longer term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior mightneed to be replaced with a new PCI_ERS_RESULT_PANIC.
Key phrases: crash
CVE-2024-26763: In the Linux kernel, the following vulnerability has been resolved:dm-crypt: don't modify the data when using authenticated encryptionIt was said that authenticated encryption could produce invalid tag whenthe data that is being encrypted is modified [1]. So, fix this problem bycopying the data into the clone bio first and then encrypt them inside theclone bio.This may reduce performance, but it is needed to prevent the user fromcorrupting the device by writing data with O_DIRECT and modifying them atthe same time.[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/
Key phrases: performance
CVE-2024-26764: In the Linux kernel, the following vulnerability has been resolved:fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaioIf kiocb_set_cancel_fn() is called for I/O submitted via io_uring, thefollowing kernel warning appears:WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8Call trace: kiocb_set_cancel_fn+0x9c/0xa8 ffs_epfile_read_iter+0x144/0x1d0 io_read+0x19c/0x498 io_issue_sqe+0x118/0x27c io_submit_sqes+0x25c/0x5fc __arm64_sys_io_uring_enter+0x104/0xab0 invoke_syscall+0x58/0x11c el0_svc_common+0xb4/0xf4 do_el0_svc+0x2c/0xb0 el0_svc+0x2c/0xa4 el0t_64_sync_handler+0x68/0xb4 el0t_64_sync+0x1a4/0x1a8Fix this by setting the IOCB_AIO_RW flag for read and write I/O that issubmitted by libaio.
CVE-2024-26765: In the Linux kernel, the following vulnerability has been resolved:LoongArch: Disable IRQ before init_fn() for nonboot CPUsDisable IRQ before init_fn() for nonboot CPUs when hotplug, in order tosilence such warnings (and also avoid potential errors due to unexpectedinterrupts):WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:4503 rcu_cpu_starting+0x214/0x280CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.17+ #1198pc 90000000048e3334 ra 90000000047bd56c tp 900000010039c000 sp 900000010039fdd0a0 0000000000000001 a1 0000000000000006 a2 900000000802c040 a3 0000000000000000a4 0000000000000001 a5 0000000000000004 a6 0000000000000000 a7 90000000048e3f4ct0 0000000000000001 t1 9000000005c70968 t2 0000000004000000 t3 000000000005e56et4 00000000000002e4 t5 0000000000001000 t6 ffffffff80000000 t7 0000000000040000t8 9000000007931638 u0 0000000000000006 s9 0000000000000004 s0 0000000000000001s1 9000000006356ac0 s2 9000000007244000 s3 0000000000000001 s4 0000000000000001s5 900000000636f000 s6 7fffffffffffffff s7 9000000002123940 s8 9000000001ca55f8   ra: 90000000047bd56c tlb_init+0x24c/0x528  ERA: 90000000048e3334 rcu_cpu_starting+0x214/0x280 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 00000000 (PPLV0 -PIE -PWE) EUEN: 00000000 (-FPE -SXE -ASXE -BTE) ECFG: 00071000 (LIE=12 VS=7)ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0) PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.17+ #1198Stack : 0000000000000000 9000000006375000 9000000005b61878 900000010039c000        900000010039fa30 0000000000000000 900000010039fa38 900000000619a140        9000000006456888 9000000006456880 900000010039f950 0000000000000001        0000000000000001 cb0cb028ec7e52e1 0000000002b90000 9000000100348700        0000000000000000 0000000000000001 ffffffff916d12f1 0000000000000003        0000000000040000 9000000007930370 0000000002b90000 0000000000000004        9000000006366000 900000000619a140 0000000000000000 0000000000000004        0000000000000000 0000000000000009 ffffffffffc681f2 9000000002123940        9000000001ca55f8 9000000006366000 90000000047a4828 00007ffff057ded8        00000000000000b0 0000000000000000 0000000000000000 0000000000071000        ...Call Trace:[<90000000047a4828>] show_stack+0x48/0x1a0[<9000000005b61874>] dump_stack_lvl+0x84/0xcc[<90000000047f60ac>] __warn+0x8c/0x1e0[<9000000005b0ab34>] report_bug+0x1b4/0x280[<9000000005b63110>] do_bp+0x2d0/0x480[<90000000047a2e20>] handle_bp+0x120/0x1c0[<90000000048e3334>] rcu_cpu_starting+0x214/0x280[<90000000047bd568>] tlb_init+0x248/0x528[<90000000047a4c44>] per_cpu_trap_init+0x124/0x160[<90000000047a19f4>] cpu_probe+0x494/0xa00[<90000000047b551c>] start_secondary+0x3c/0xc0[<9000000005b66134>] smpboot_entry+0x50/0x58
CVE-2024-26766: In the Linux kernel, the following vulnerability has been resolved:IB/hfi1: Fix sdma.h tx->num_descs off-by-one errorUnfortunately the commit `fd8958efe877` introduced another errorcausing the `descs` array to overflow. This reults in further crasheseasily reproducible by `sendmsg` system call.[ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI[ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1]--[ 1080.974535] Call Trace:[ 1080.976990]  <TASK>[ 1081.021929]  hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1][ 1081.027364]  hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1][ 1081.032633]  hfi1_ipoib_send+0x112/0x300 [hfi1][ 1081.042001]  ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib][ 1081.046978]  dev_hard_start_xmit+0xc4/0x210--[ 1081.148347]  __sys_sendmsg+0x59/0xa0crash> ipoib_txreq 0xffff9cfeba229f00struct ipoib_txreq {  txreq = {    list = {      next = 0xffff9cfeba229f00,      prev = 0xffff9cfeba229f00    },    descp = 0xffff9cfeba229f40,    coalesce_buf = 0x0,    wait = 0xffff9cfea4e69a48,    complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>,    packet_len = 0x46d,    tlen = 0x0,    num_desc = 0x0,    desc_limit = 0x6,    next_descq_idx = 0x45c,    coalesce_idx = 0x0,    flags = 0x0,    descs = {{        qw = {0x8024000120dffb00, 0x4}  # SDMA_DESC0_FIRST_DESC_FLAG (bit 63)      }, {        qw = {  0x3800014231b108, 0x4}      }, {        qw = { 0x310000e4ee0fcf0, 0x8}      }, {        qw = {  0x3000012e9f8000, 0x8}      }, {        qw = {  0x59000dfb9d0000, 0x8}      }, {        qw = {  0x78000e02e40000, 0x8}      }}  },  sdma_hdr =  0x400300015528b000,  <<< invalid pointer in the tx request structure  sdma_status = 0x0,                   SDMA_DESC0_LAST_DESC_FLAG (bit 62)  complete = 0x0,  priv = 0x0,  txq = 0xffff9cfea4e69880,  skb = 0xffff9d099809f400}If an SDMA send consists of exactly 6 descriptors and requires dwordpadding (in the 7th descriptor), the sdma_txreq descriptor array is notproperly expanded and the packet will overflow into the containerstructure. This results in a panic when the send completion runs. Theexact panic varies depending on what elements of the container structureget corrupted. The fix is to use the correct expression in_pad_sdma_tx_descs() to test the need to expand the descriptor array.With this patch the crashes are no longer reproducible and the machine isstable.
Key phrases: crash
CVE-2024-26767: In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: fixed integer types and null check locations[why]:issues fixed:- comparison with wider integer type in loop condition which can causeinfinite loops- pointer dereference before null check
Key phrases: null check locations, pointer dereference
CVE-2024-26769: In the Linux kernel, the following vulnerability has been resolved:nvmet-fc: avoid deadlock on delete association pathWhen deleting an association the shutdown path is deadlocking because wetry to flush the nvmet_wq nested. Avoid this by deadlock by deferringthe put work into its own work item.
CVE-2024-2677: A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/category/controller.php. The manipulation of the argument CATEGORYID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257377 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2024-26770: In the Linux kernel, the following vulnerability has been resolved:HID: nvidia-shield: Add missing null pointer checks to LED initializationdevm_kasprintf() returns a pointer to dynamically allocated memorywhich can be NULL upon failure. Ensure the allocation was successfulby checking the pointer validity.[jkosina@suse.com: tweak changelog a bit]
Key phrases: null pointer
CVE-2024-26771: In the Linux kernel, the following vulnerability has been resolved:dmaengine: ti: edma: Add some null pointer checks to the edma_probedevm_kasprintf() returns a pointer to dynamically allocated memorywhich can be NULL upon failure. Ensure the allocation was successfulby checking the pointer validity.
Key phrases: null pointer
CVE-2024-26772: In the Linux kernel, the following vulnerability has been resolved:ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()Places the logic for checking if the group's block bitmap is corrupt underthe protection of the group lock to avoid allocating blocks from the groupwith a corrupted block bitmap.
Key phrases: corrupted group
CVE-2024-26773: In the Linux kernel, the following vulnerability has been resolved:ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()Determine if the group block bitmap is corrupted before using ac_b_ex inext4_mb_try_best_found() to avoid allocating blocks from a group with acorrupted block bitmap in the following concurrency and making thesituation worse.ext4_mb_regular_allocator  ext4_lock_group(sb, group)  ext4_mb_good_group   // check if the group bbitmap is corrupted  ext4_mb_complex_scan_group   // Scan group gets ac_b_ex but doesn't use it  ext4_unlock_group(sb, group)                           ext4_mark_group_bitmap_corrupted(group)                           // The block bitmap was corrupted during                           // the group unlock gap.  ext4_mb_try_best_found    ext4_lock_group(ac->ac_sb, group)    ext4_mb_use_best_found      mb_mark_used      // Allocating blocks in block bitmap corrupted group
Key phrases: corrupted group
CVE-2024-26774: In the Linux kernel, the following vulnerability has been resolved:ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corruptDetermine if bb_fragments is 0 instead of determining bb_free to eliminatethe risk of dividing by zero when the block bitmap is corrupted.
CVE-2024-26775: In the Linux kernel, the following vulnerability has been resolved:aoe: avoid potential deadlock at set_capacityMove set_capacity() outside of the section procected by (&d->lock).To avoid possible interrupt unsafe locking scenario:        CPU0                    CPU1        ----                    ----[1] lock(&bdev->bd_size_lock);                                local_irq_disable();                            [2] lock(&d->lock);                            [3] lock(&bdev->bd_size_lock);   <Interrupt>[4]  lock(&d->lock);  *** DEADLOCK ***Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity().[2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc()is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call.In this situation an attempt to acquire [4]lock(&d->lock) fromaoecmd_cfg_rsp() will lead to deadlock.So the simplest solution is breaking lock dependency[2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity()outside.
CVE-2024-26776: In the Linux kernel, the following vulnerability has been resolved:spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detectedReturn IRQ_NONE from the interrupt handler when no interrupt wasdetected. Because an empty interrupt will cause a null pointer error:    Unable to handle kernel NULL pointer dereference at virtual  address 0000000000000008    Call trace:        complete+0x54/0x100        hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]        __handle_irq_event_percpu+0x64/0x1e0        handle_irq_event+0x7c/0x1cc
Key phrases: null pointer
CVE-2024-26777: In the Linux kernel, the following vulnerability has been resolved:fbdev: sis: Error out if pixclock equals zeroThe userspace program could pass any values to the driver throughioctl() interface. If the driver doesn't check the value of pixclock,it may cause divide-by-zero error.In sisfb_check_var(), var->pixclock is used as a divisor to caculatedrate before it is checked against zero. Fix this by checking itat the beginning.This is similar to CVE-2022-3061 in i740fb which was fixed bycommit 15cf0b8.
CVE-2024-26778: In the Linux kernel, the following vulnerability has been resolved:fbdev: savage: Error out if pixclock equals zeroThe userspace program could pass any values to the driver throughioctl() interface. If the driver doesn't check the value of pixclock,it may cause divide-by-zero error.Although pixclock is checked in savagefb_decode_var(), but it is notchecked properly in savagefb_probe(). Fix this by checking whetherpixclock is zero in the function savagefb_check_var() beforeinfo->var.pixclock is used as the divisor.This is similar to CVE-2022-3061 in i740fb which was fixed bycommit 15cf0b8.
CVE-2024-26779: In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: fix race condition on enabling fast-xmitfast-xmit must only be enabled after the sta has been uploaded to the driver,otherwise it could end up passing the not-yet-uploaded sta via drv_tx callsto the driver, leading to potential crashes because of uninitialized drv_privdata.Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.
Key phrases: race condition, crash
CVE-2024-2678: A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/applicants/controller.php. The manipulation of the argument JOBREGID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257378 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2024-2679: A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/vacancy/index.php. The manipulation of the argument view leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257379.
Key phrases: cross site scripting, cross-site scripting
CVE-2024-2680: A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user/index.php. The manipulation of the argument view leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257380.
Key phrases: cross site scripting
CVE-2024-2681: A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/employee/index.php. The manipulation of the argument view leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257381 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2024-2682: A vulnerability classified as problematic has been found in Campcodes Online Job Finder System 1.0. Affected is an unknown function of the file /admin/employee/controller.php. The manipulation of the argument EMPLOYEEID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257382 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2024-2683: A vulnerability classified as problematic was found in Campcodes Online Job Finder System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/company/index.php. The manipulation of the argument view leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257383.
Key phrases: cross site scripting
CVE-2024-2684: A vulnerability, which was classified as problematic, has been found in Campcodes Online Job Finder System 1.0. Affected by this issue is some unknown functionality of the file /admin/category/index.php. The manipulation of the argument view leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257384.
Key phrases: cross site scripting
CVE-2024-2685: A vulnerability, which was classified as problematic, was found in Campcodes Online Job Finder System 1.0. This affects an unknown part of the file /admin/applicants/index.php. The manipulation of the argument view leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257385 was assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2024-2686: A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/applicants/controller.php. The manipulation of the argument JOBREGID leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257386 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2024-2687: A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/applicants/index.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257387.
Key phrases: sql injection
CVE-2024-2688: The EmbedPress  Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress document widget in all versions up to, and including, 3.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2024-2689: Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted.In this context, a user is an operator of Temporal Server.
Key phrases: interact with workflows and has crafted an invalid, invalid string, queue lag
CVE-2024-2690: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file /uupdate.php. The manipulation of the argument ima leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257388.
Key phrases: unrestricted upload
CVE-2024-2692: SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
Key phrases: executing arbitrary commands, Server Side XSS, server side xss, execute arbitrary
CVE-2024-2702: Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import allows importing settings and data, ultimately leading to XSS.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.
Key phrases: XSS.This issue affects Olive One Click Demo Import, missing authorization, xss
CVE-2024-2703: A vulnerability classified as critical has been found in Tenda AC10U 15.03.06.49. Affected is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257454 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-2704: A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49. Affected by this vulnerability is the function formSetFirewallCfg of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257455. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-2705: A vulnerability, which was classified as critical, has been found in Tenda AC10U 1.0/15.03.06.49. Affected by this issue is the function formSetQosBand of the file /goform/SetNetControlList. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257456. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-2706: A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.49. This affects the function formWifiWpsStart of the file /goform/WifiWpsStart. The manipulation of the argument index leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257457 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-2707: A vulnerability has been found in Tenda AC10U 15.03.06.49 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257458 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: os command injection, disclosure
CVE-2024-2708: A vulnerability was found in Tenda AC10U 15.03.06.49 and classified as critical. This issue affects the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257459. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-27081: ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.  This vulnerability is patched in 2024.2.1.
Key phrases: write arbitrary files, read and write arbitrary files under the configuration, security misconfiguration, remote code execution
CVE-2024-27083: Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.
Key phrases: cross-site scripting (xss)
CVE-2024-27085: Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable invites or restrict access to them using the `invite allowed groups` site setting. 
Key phrases: arbitrarily large data
CVE-2024-27087: Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats.  As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.
Key phrases: execute arbitrary JavaScript code, the relevant URL format, execute arbitrary JavaScript code when a user or, arbitrary javascript code
CVE-2024-27088: es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.
Key phrases: stall
CVE-2024-2709: A vulnerability was found in Tenda AC10U 15.03.06.49. It has been classified as critical. Affected is the function fromSetRouteStatic of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257460. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-27091: GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.
Key phrases: stored xss
CVE-2024-27092: Hoppscotch is an API development ecosystem.  Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achieve own goals by malicious actors.  This issue is fixed in 2023.12.6.
Key phrases: clickable form, own goals
CVE-2024-27093: Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database).  When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result.  Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully.  Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability.  This vulnerability is patched in version 0.20240226.1425+ref.53868a8.
Key phrases: denial-of-service, denial of service
CVE-2024-27094: OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
CVE-2024-27096: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13.
Key phrases: sql injection
CVE-2024-27097: A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.
Key phrases: false log entries
CVE-2024-27098: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.
Key phrases: using Arbitrary Object Instantiation, ssrf based, arbitrary object instantiation
CVE-2024-27099: The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.
Key phrases: rce, double free
CVE-2024-2710: A vulnerability was found in Tenda AC10U 15.03.06.49. It has been declared as critical. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257461 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure
CVE-2024-27100: Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could render an instance inoperable. A site could be disrupted by either a malicious moderator on the same site or a malicious staff member on another site in the same multisite cluster. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Key phrases: excessive resource consumption
CVE-2024-27101: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic.  Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem.  The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.
Key phrases: integer overflow
CVE-2024-27102: Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory (sandbox root) is possible. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. Details on the exploitation of this vulnerability are embargoed until March 27th, 2024 at 18:00 UTC. In order to mitigate this vulnerability, a full rewrite of the entire server filesystem was necessary. Because of this, the size of the patch is massive, however effort was made to reduce the amount of breaking changes. Users are advised to update to version 1.11.9. There are no known workarounds for this vulnerability.
Key phrases: pterodactyl panel, scope of impact
CVE-2024-27103: Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this feature uses dangerouslySetInnerHTML which means that if the highlighted result has an XSS payload it will trigger. While the input to dangerouslySetInnerHTML is not sanitized for the data inside of queries which leads to an XSS vulnerability. During the "query auto-suggestion" the name of the suggested tables are set with innerHTML which leads to the XSS vulnerability. A patch to rectify this issue has been introduced in Querybook version 3.31.2.
Key phrases: xss payload
CVE-2024-27104: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.
Key phrases: xss
CVE-2024-27105: Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds are available.
Key phrases: file permission, permission bypass
CVE-2024-2711: A vulnerability was found in Tenda AC10U 15.03.06.48. It has been rated as critical. Affected by this issue is the function addWifiMacFilter of the file /goform/addWifiMacFilter. The manipulation of the argument deviceMac leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257462 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Key phrases: stack-based buffer overflow, stack based buffer overflow, disclosure