yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-52285: ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter.
Key phrases: SQL Injection via the /Support/action/, sql injection
CVE-2023-52286: Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get_db_info request, a related issue to CVE-2023-42387.
Key phrases: discover database credentials via an index.php/api/install/get_db_info request
CVE-2023-52288: An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resource-data/<file_path>.txt URI (from views.py), allows attackers to read arbitrary files.
Key phrases: read arbitrary files, directory traversal
CVE-2023-52289: An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/<file_path> URI (from views.py), allows attackers to write to arbitrary files.
Key phrases: write to arbitrary files, directory traversal
CVE-2023-5229: The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2023-52296: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service when querying a specific UDF built-in function concurrently.  IBM X-Force ID:  278547.
Key phrases: denial of service
CVE-2023-5230: The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-52302: Nullptr in paddle.nextafterin PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
Key phrases: runtime crash, denial of service
CVE-2023-52303: Nullptr in paddle.put_along_axisin PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
Key phrases: runtime crash, denial of service
CVE-2023-52304: Stack overflow in paddle.searchsortedin PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.
Key phrases: stack overflow, damage, denial of service
CVE-2023-52305: FPE in paddle.topkin PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
Key phrases: denial of service, crash
CVE-2023-52306: FPE in paddle.lerpin PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
Key phrases: denial of service, crash
CVE-2023-52307: Stack overflow in paddle.linalg.lu_unpackin PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.
Key phrases: stack overflow, damage, denial of service
CVE-2023-52308: FPE in paddle.aminin PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
Key phrases: denial of service, crash
CVE-2023-52309: Heap buffer overflow in paddle.repeat_interleavein PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
Key phrases: heap buffer overflow, denial of service, information disclosure, damage
CVE-2023-5231: The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-52310: PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating system.
Key phrases: execute arbitrary commands, command injection
CVE-2023-52311: PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system.
Key phrases: execute arbitrary commands, command injection
CVE-2023-52312: Nullptr dereference in paddle.cropin PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
Key phrases: nullptr dereference, runtime crash, denial of service
CVE-2023-52313: FPE in paddle.argmin and paddle.argmaxin PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
Key phrases: denial of service, crash
CVE-2023-52314: PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.
Key phrases: execute arbitrary commands, command injection
CVE-2023-5232: The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-52322: ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.
Key phrases: safe characters such as alphanumerics, xss
CVE-2023-52323: PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.
Key phrases: side-channel leakage for OAEP decryption, exploitable, manger
CVE-2023-52324: An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations.Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.
Key phrases: create arbitrary files, create arbitrary files on affected installations, file upload, unrestricted file upload, execute arbitrary, execute arbitrary code
CVE-2023-52325: A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations.Please note: this vulnerability must be used in conjunction with another one to exploit an affected system. In addition, an attacker must first obtain a valid set of credentials on target system in order to exploit this vulnerability.
Key phrases: execute arbitrary code, obtain a valid set of credentials, execute arbitrary code on affected installations, local file inclusion
CVE-2023-52326: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.Please note this vulnerability is similar, but not identical to CVE-2023-52327.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-52327: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.Please note this vulnerability is similar, but not identical to CVE-2023-52328.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-52328: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.Please note this vulnerability is similar, but not identical to CVE-2023-52329.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-52329: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.Please note this vulnerability is similar, but not identical to CVE-2023-52326.
Key phrases: achieve remote code execution on affected servers, cross-site scripting (xss)
CVE-2023-5233: The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-52330: A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central.Please note: user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Trend, cross-site scripting
CVE-2023-52331: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local services directly.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, interact with internal or local services directly, post-authenticated server-side request forgery (ssrf), server side request forgery
CVE-2023-52337: An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on affected installations, access control, improper access control
CVE-2023-52338: A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on affected installations
CVE-2023-52339: In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.
Key phrases: integer overflow, buffer overflows
CVE-2023-5234: The Related Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'woo-related' shortcode in versions up to, and including, 3.3.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-5235: The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks.
Key phrases: update blog options, object injection
CVE-2023-52353: An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last connection negotiated TLS 1.2, then 1.2 becomes the new maximum.
CVE-2023-52354: chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.
Key phrases: SMTP smuggling because LF-terminated lines are, smtp smuggling, lf-terminated lines
CVE-2023-52355: An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
Key phrases: cause a denial of service via a crafted, out-of-memory flaw
CVE-2023-52356: A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
Key phrases: cause a heap-buffer overflow, segment fault (segv), denial of service, heap buffer overflow
CVE-2023-52357: Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability.
Key phrases: vulnerability of serialization deserialization mismatch, availability
CVE-2023-52358: Vulnerability of configuration defects in some APIs of the audio module.Successful exploitation of this vulnerability may affect availability.
Key phrases: vulnerability of configuration defects, availability
CVE-2023-5236: A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
Key phrases: circular object references, denial of service
CVE-2023-52360: Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.
Key phrases: logic, service integrity
CVE-2023-52361: The VerifiedBoot module has a vulnerability that may cause authentication errors.Successful exploitation of this vulnerability may affect integrity.
Key phrases: verifiedboot module, integrity
CVE-2023-52362: Permission management vulnerability in the lock screen module.Successful exploitation of this vulnerability may affect availability.
Key phrases: permission management, availability
CVE-2023-52363: Vulnerability of defects introduced in the design process in the Control Panel module.Successful exploitation of this vulnerability may cause app processes to be started by mistake.
Key phrases: vulnerability of defects, app processes
CVE-2023-52365: Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormally.
Key phrases: out-of-bounds read, perform abnormally, out of bounds read
CVE-2023-52366: Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormally.
Key phrases: out-of-bounds read, perform abnormally, out of bounds read
CVE-2023-52367: Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrity.
Key phrases: vulnerability of improper access control, service availability, integrity
CVE-2023-52368: Input verification vulnerability in the account module.Successful exploitation of this vulnerability may cause features to perform abnormally.
Key phrases: input verification, perform abnormally
CVE-2023-52369: Stack overflow vulnerability in the NFC module.Successful exploitation of this vulnerability may affect service availability and integrity.
Key phrases: stack overflow, service availability, integrity
CVE-2023-5237: The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2023-52370: Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause unauthorized file access.
Key phrases: stack overflow, unauthorized file access
CVE-2023-52371: Vulnerability of null references in the motor module.Successful exploitation of this vulnerability may affect availability.
Key phrases: vulnerability of null references, availability
CVE-2023-52372: Vulnerability of input parameter verification in the motor module.Successful exploitation of this vulnerability may affect availability.
Key phrases: input parameter verification, availability
CVE-2023-52373: Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.
Key phrases: vulnerability of permission verification, unauthorized file sharing
CVE-2023-52374: Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: permission control, service confidentiality
CVE-2023-52375: Permission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may affect availability.
Key phrases: permission control, availability
CVE-2023-52376: Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: information management, service confidentiality
CVE-2023-52377: Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerability may cause out-of-bounds access.
Key phrases: out-of-bounds access, out of bounds access
CVE-2023-52378: Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnormally.
Key phrases: perform abnormally
CVE-2023-52379: Permission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: permission control, service confidentiality
CVE-2023-5238: The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
Key phrases: html injection
CVE-2023-52380: Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: vulnerability of improper access control, service confidentiality
CVE-2023-52381: Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
Key phrases: script injection, service confidentiality, availability, confidentiality and integrity, integrity and availability
CVE-2023-52387: Resource reuse vulnerability in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality.
Key phrases: resource reuse, service confidentiality
CVE-2023-52389: UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.
Key phrases: integer overflow, stack buffer overflow
CVE-2023-5239: The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection.
Key phrases: bypass bruteforce protection, manipulate its value, untrusted headers
CVE-2023-5240: Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request.
Key phrases: manage PAM propagation scripts to retrieve passwords stored, improper access control
CVE-2023-5241: The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php.
Key phrases: append "<?php" to any, directory traversal, dos
CVE-2023-52425: libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
Key phrases: denial of service (resource consumption), a denial of service (resource consumption)
CVE-2023-52426: libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
Key phrases: recursive XML Entity Expansion if XML_DTD is undefined, recursive xml entity expansion
CVE-2023-52427: In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resource_limits.max_samples. NOTE: the vendor's position is that the product is not designed to handle a max_samples value that is too large for the amount of memory on the system.
Key phrases: segmentation fault
CVE-2023-52428: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
Key phrases: denial of service (resource consumption)
CVE-2023-52429: dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.
Key phrases: crash
CVE-2023-5243: The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2023-52430: The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.
Key phrases: a URL that contains an XSS payload and, xss, xss payload
CVE-2023-52431: The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie (if signed cookies are disabled).
Key phrases: bypass a CSRF protection, bypass a CSRF protection mechanism via an empty, empty form value, empty cookie
CVE-2023-52432: Improper input validation in IpcTxSndSetLoopbackCtrl in libsec-ril prior to SMR Sep-2023 Release 1 allows local attackers to write out-of-bounds memory.
Key phrases: write out-of-bounds memory, improper input validation, out of bounds memory
CVE-2023-52433: In the Linux kernel, the following vulnerability has been resolved:netfilter: nft_set_rbtree: skip sync GC for new elements in this transactionNew elements in this transaction might expired before such transactionends. Skip sync GC for such elements otherwise commit path might walkover an already released object. Once transaction is finished, async GCwill collect such expired element.
CVE-2023-52434: In the Linux kernel, the following vulnerability has been resolved:smb: client: fix potential OOBs in smb2_parse_contexts()Validate offsets and lengths before dereferencing create contexts insmb2_parse_contexts().This fixes following oops when accessing invalid create contexts fromserver:  BUG: unable to handle page fault for address: ffff8881178d8cc3  #PF: supervisor read access in kernel mode  #PF: error_code(0x0000) - not-present page  PGD 4a01067 P4D 4a01067 PUD 0  Oops: 0000 [#1] PREEMPT SMP NOPTI  CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014  RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]  Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00  00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7  7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00  RSP: 0018:ffffc900007939e0 EFLAGS: 00010216  RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90  RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000  RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000  R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000  R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22  FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)  knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0  PKRU: 55555554  Call Trace:   <TASK>   ? __die+0x23/0x70   ? page_fault_oops+0x181/0x480   ? search_module_extables+0x19/0x60   ? srso_alias_return_thunk+0x5/0xfbef5   ? exc_page_fault+0x1b6/0x1c0   ? asm_exc_page_fault+0x26/0x30   ? smb2_parse_contexts+0xa0/0x3a0 [cifs]   SMB2_open+0x38d/0x5f0 [cifs]   ? smb2_is_path_accessible+0x138/0x260 [cifs]   smb2_is_path_accessible+0x138/0x260 [cifs]   cifs_is_path_remote+0x8d/0x230 [cifs]   cifs_mount+0x7e/0x350 [cifs]   cifs_smb3_do_mount+0x128/0x780 [cifs]   smb3_get_tree+0xd9/0x290 [cifs]   vfs_get_tree+0x2c/0x100   ? capable+0x37/0x70   path_mount+0x2d7/0xb80   ? srso_alias_return_thunk+0x5/0xfbef5   ? _raw_spin_unlock_irqrestore+0x44/0x60   __x64_sys_mount+0x11a/0x150   do_syscall_64+0x47/0xf0   entry_SYSCALL_64_after_hwframe+0x6f/0x77  RIP: 0033:0x7f8737657b1e
CVE-2023-52436: In the Linux kernel, the following vulnerability has been resolved:f2fs: explicitly null-terminate the xattr listWhen setting an xattr, explicitly null-terminate the xattr list.  Thiseliminates the fragile assumption that the unused xattr space is alwayszeroed.
CVE-2023-52438: In the Linux kernel, the following vulnerability has been resolved:binder: fix use-after-free in shinker's callbackThe mmap read lock is used during the shrinker's callback, which meansthat using alloc->vma pointer isn't safe as it can race with munmap().As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem inmunmap") the mmap lock is downgraded after the vma has been isolated.I was able to reproduce this issue by manually adding some delays andtriggering page reclaiming through the shrinker's debug sysfs. Thefollowing KASAN report confirms the UAF:  ==================================================================  BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8  Read of size 8 at addr ffff356ed50e50f0 by task bash/478  CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70  Hardware name: linux,dummy-virt (DT)  Call trace:   zap_page_range_single+0x470/0x4b8   binder_alloc_free_page+0x608/0xadc   __list_lru_walk_one+0x130/0x3b0   list_lru_walk_node+0xc4/0x22c   binder_shrink_scan+0x108/0x1dc   shrinker_debugfs_scan_write+0x2b4/0x500   full_proxy_write+0xd4/0x140   vfs_write+0x1ac/0x758   ksys_write+0xf0/0x1dc   __arm64_sys_write+0x6c/0x9c  Allocated by task 492:   kmem_cache_alloc+0x130/0x368   vm_area_alloc+0x2c/0x190   mmap_region+0x258/0x18bc   do_mmap+0x694/0xa60   vm_mmap_pgoff+0x170/0x29c   ksys_mmap_pgoff+0x290/0x3a0   __arm64_sys_mmap+0xcc/0x144  Freed by task 491:   kmem_cache_free+0x17c/0x3c8   vm_area_free_rcu_cb+0x74/0x98   rcu_core+0xa38/0x26d4   rcu_core_si+0x10/0x1c   __do_softirq+0x2fc/0xd24  Last potentially related work creation:   __call_rcu_common.constprop.0+0x6c/0xba0   call_rcu+0x10/0x1c   vm_area_free+0x18/0x24   remove_vma+0xe4/0x118   do_vmi_align_munmap.isra.0+0x718/0xb5c   do_vmi_munmap+0xdc/0x1fc   __vm_munmap+0x10c/0x278   __arm64_sys_munmap+0x58/0x7cFix this issue by performing instead a vma_lookup() which will fail tofind the vma that was isolated before the mmap lock downgrade. Note thatthis option has better performance than upgrading to a mmap write lockwhich would increase contention. Plus, mmap_write_trylock() has beenrecently removed anyway.
Key phrases: use after free
CVE-2023-52439: In the Linux kernel, the following vulnerability has been resolved:uio: Fix use-after-free in uio_opencore-1				core-2-------------------------------------------------------uio_unregister_device		uio_open				idev = idr_find()device_unregister(&idev->dev)put_device(&idev->dev)uio_device_release				get_device(&idev->dev)kfree(idev)uio_free_minor(minor)				uio_release				put_device(&idev->dev)				kfree(idev)-------------------------------------------------------In the core-1 uio_unregister_device(), the device_unregister will kfreeidev when the idev->dev kobject ref is 1. But after core-1device_unregister, put_device and before doing kfree, the core-2 mayget_device. Then:1. After core-1 kfree idev, the core-2 will do use-after-free for idev.2. When core-2 do uio_release and put_device, the idev will be double   freed.To address this issue, we can get idev atomic & inc idev reference withminor_lock.
Key phrases: use-after-free, use after free
CVE-2023-5244: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
Key phrases: cross-site scripting (xss)
CVE-2023-52440: In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()If authblob->SessionKey.Length is bigger than session keysize(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes.cifs_arc4_crypt copy to session key array from SessionKey from client.
Key phrases: slub overflow
CVE-2023-52441: In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix out of bounds in init_smb2_rsp_hdr()If client send smb2 negotiate request and then send smb1 negotiaterequest, init_smb2_rsp_hdr is called for smb1 negotiate request sinceneed_neg is set to false. This patch ignore smb1 packets after ->need_negis set to false.
Key phrases: out of bounds
CVE-2023-52442: In the Linux kernel, the following vulnerability has been resolved:ksmbd: validate session id and tree id in compound request`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session()will always return the first request smb2 header in a compound request.if `SMB2_TREE_CONNECT_HE` is the first command in compound request, willreturn 0, i.e. The tree id check is skipped.This patch use ksmbd_req_buf_next() to get current command in compound.
CVE-2023-52443: In the Linux kernel, the following vulnerability has been resolved:apparmor: avoid crash when parsed profile name is emptyWhen processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}"a string ":samba-dcerpcd" is unpacked as a fully-qualified name and thenpassed to aa_splitn_fqname().aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace.Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Lateraa_alloc_profile() crashes as the new profile name is NULL now.general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014RIP: 0010:strlen+0x1e/0xa0Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK>---[ end trace 0000000000000000 ]---RIP: 0010:strlen+0x1e/0xa0It seems such behaviour of aa_splitn_fqname() is expected and checked inother places where it is called (e.g. aa_remove_profiles). Well, thereis an explicit comment "a ns name without a following profile is allowed"inside.AFAICS, nothing can prevent unpacked "name" to be in form like":samba-dcerpcd" - it is passed from userspace.Deny the whole profile set replacement in such case and inform user withEPROTO and an explaining message.Found by Linux Verification Center (linuxtesting.org).
Key phrases: crash
CVE-2023-52444: In the Linux kernel, the following vulnerability has been resolved:f2fs: fix to avoid dirent corruptionAs Al reported in link[1]:f2fs_rename()...	if (old_dir != new_dir && !whiteout)		f2fs_set_link(old_inode, old_dir_entry,					old_dir_page, new_dir);	else		f2fs_put_page(old_dir_page, 0);You want correct inumber in the ".." link.  And cross-directoryrename does move the source to new parent, even if you'd been askedto leave a whiteout in the old place.[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/With below testcase, it may cause dirent corruption, due to it missedto call f2fs_set_link() to update ".." link to new directory.- mkdir -p dir/foo- renameat2 -w dir/foo bar[ASSERT] (__chk_dots_dentries:1421)  --> Bad inode number[0x4] for '..', parent parent ino is [0x3][FSCK] other corrupted bugs                           [Fail]
Key phrases: dirent corruptionas
CVE-2023-52445: In the Linux kernel, the following vulnerability has been resolved:media: pvrusb2: fix use after free on context disconnectionUpon module load, a kthread is created targeting thepvr2_context_thread_func function, which may call pvr2_context_destroyand thus call kfree() on the context object. However, that might happenbefore the usb hub_event handler is able to notify the driver. Thispatch adds a sanity check before the invalid read reported by syzbot,within the context disconnection call stack.
Key phrases: use after free, invalid read
CVE-2023-52447: In the Linux kernel, the following vulnerability has been resolved:bpf: Defer the free of inner map when necessaryWhen updating or deleting an inner map in map array or map htab, the mapmay still be accessed by non-sleepable program or sleepable program.However bpf_map_fd_put_ptr() decreases the ref-counter of the inner mapdirectly through bpf_map_put(), if the ref-counter is the last one(which is true for most cases), the inner map will be freed byops->map_free() in a kworker. But for now, most .map_free() callbacksdon't use synchronize_rcu() or its variants to wait for the elapse of aRCU grace period, so after the invocation of ops->map_free completes,the bpf program which is accessing the inner map may incuruse-after-free problem.Fix the free of inner map by invoking bpf_map_free_deferred() after bothone RCU grace period and one tasks trace RCU grace period if the innermap has been removed from the outer map before. The deferment isaccomplished by using call_rcu() or call_rcu_tasks_trace() whenreleasing the last ref-counter of bpf map. The newly-added rcu_headfield in bpf_map shares the same storage space with work field toreduce the size of bpf_map.
CVE-2023-52448: In the Linux kernel, the following vulnerability has been resolved:gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dumpSyzkaller has reported a NULL pointer dereference when accessingrgd->rd_rgl in gfs2_rgrp_dump().  This can happen when creatingrgd->rd_gl fails in read_rindex_entry().  Add a NULL pointer check ingfs2_rgrp_dump() to prevent that.
Key phrases: null pointer dereference
CVE-2023-52449: In the Linux kernel, the following vulnerability has been resolved:mtd: Fix gluebi NULL pointer dereference caused by ftl notifierIf both ftl.ko and gluebi.ko are loaded, the notifier of ftltriggers NULL pointer dereference when trying to accessgluebi->desc in gluebi_read().ubi_gluebi_init  ubi_register_volume_notifier    ubi_enumerate_volumes      ubi_notify_all        gluebi_notify    nb->notifier_call()          gluebi_create            mtd_device_register              mtd_device_parse_register                add_mtd_device                  blktrans_notify_add   not->add()                    ftl_add_mtd         tr->add_mtd()                      scan_header                        mtd_read                          mtd_read_oob                            mtd_read_oob_std                              gluebi_read   mtd->read()                                gluebi->desc - NULLDetailed reproduction information available at the Link [1],In the normal case, obtain gluebi->desc in the gluebi_get_device(),and access gluebi->desc in the gluebi_read(). However,gluebi_get_device() is not executed in advance in theftl_add_mtd() process, which leads to NULL pointer dereference.The solution for the gluebi module is to run jffs2 on the UBIvolume without considering working with ftl or mtdblock [2].Therefore, this problem can be avoided by preventing gluebi fromcreating the mtdblock device after creating mtd partition of thetype MTD_UBIVOLUME.
Key phrases: obtain gluebi->desc in the gluebi_get_device(),and access, gluebi null pointer dereference
CVE-2023-5245: FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory.When creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply() function invokes the vulnerable implementation of FileUtil.extract().Arbitrary file creation can directly lead to code execution
Key phrases: vulnerable implementation, arbitrary file creation, code execution
CVE-2023-52450: In the Linux kernel, the following vulnerability has been resolved:perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()Get logical socket id instead of physical id in discover_upi_topology()to avoid out-of-bound access on 'upi = &type->topology[nid][idx];' linethat leads to NULL pointer dereference in upi_fill_topology()
Key phrases: null pointer dereference issue, out-of-bound access
CVE-2023-52451: In the Linux kernel, the following vulnerability has been resolved:powerpc/pseries/memhp: Fix access beyond end of drmem arraydlpar_memory_remove_by_index() may access beyond the bounds of thedrmem lmb array when the LMB lookup fails to match an entry with thegiven DRC index. When the search fails, the cursor is left pointing to&drmem_info->lmbs[drmem_info->n_lmbs], which is one element past thelast valid entry in the array. The debug message at the end of thefunction then dereferences this pointer:        pr_debug("Failed to hot-remove memory at %llx\\\\n",                 lmb->base_addr);This was found by inspection and confirmed with KASAN:  pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234  ==================================================================  BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658  Read of size 8 at addr c000000364e97fd0 by task bash/949  dump_stack_lvl+0xa4/0xfc (unreliable)  print_report+0x214/0x63c  kasan_report+0x140/0x2e0  __asan_load8+0xa8/0xe0  dlpar_memory+0x298/0x1658  handle_dlpar_errorlog+0x130/0x1d0  dlpar_store+0x18c/0x3e0  kobj_attr_store+0x68/0xa0  sysfs_kf_write+0xc4/0x110  kernfs_fop_write_iter+0x26c/0x390  vfs_write+0x2d4/0x4e0  ksys_write+0xac/0x1a0  system_call_exception+0x268/0x530  system_call_vectored_common+0x15c/0x2ec  Allocated by task 1:   kasan_save_stack+0x48/0x80   kasan_set_track+0x34/0x50   kasan_save_alloc_info+0x34/0x50   __kasan_kmalloc+0xd0/0x120   __kmalloc+0x8c/0x320   kmalloc_array.constprop.0+0x48/0x5c   drmem_init+0x2a0/0x41c   do_one_initcall+0xe0/0x5c0   kernel_init_freeable+0x4ec/0x5a0   kernel_init+0x30/0x1e0   ret_from_kernel_user_thread+0x14/0x1c  The buggy address belongs to the object at c000000364e80000   which belongs to the cache kmalloc-128k of size 131072  The buggy address is located 0 bytes to the right of   allocated 98256-byte region [c000000364e80000, c000000364e97fd0)  ==================================================================  pseries-hotplug-mem: Failed to hot-remove memory at 0Log failed lookups with a separate message and dereference thecursor only when it points to a valid entry.
CVE-2023-52452: In the Linux kernel, the following vulnerability has been resolved:bpf: Fix accesses to uninit stack slotsPrivileged programs are supposed to be able to read uninitialized stackmemory (ever since 6715df8d5) but, before this patch, these accesseswere permitted inconsistently. In particular, accesses were permittedabove state->allocated_stack, but not below it. In other words, if thestack was already "large enough", the access was permitted, butotherwise the access was rejected instead of being allowed to "grow thestack". This undesired rejection was happening in two places:- in check_stack_slot_within_bounds()- in check_stack_range_initialized()This patch arranges for these accesses to be permitted. A bunch of teststhat were relying on the old rejection had to change; all of them werechanged to add also run unprivileged, in which case the old behaviorpersists. One tests couldn't be updated - global_func16 - because itcan't run unprivileged for other reasons.This patch also fixes the tracking of the stack size for variable-offsetreads. This second fix is bundled in the same commit as the first onebecause they're inter-related. Before this patch, writes to the stackusing registers containing a variable offset (as opposed to registerswith fixed, known values) were not properly contributing to thefunction's needed stack size. As a result, it was possible for a programto verify, but then to attempt to read out-of-bounds data at runtimebecause a too small stack had been allocated for it.Each function tracks the size of the stack it needs inbpf_subprog_info.stack_depth, which is maintained byupdate_stack_depth(). For regular memory accesses, check_mem_access()was calling update_state_depth() but it was passing in only the fixedpart of the offset register, ignoring the variable offset. This wasincorrect; the minimum possible value of that register should be usedinstead.This tracking is now fixed by centralizing the tracking of stack size ingrow_stack_state(), and by lifting the calls to grow_stack_state() tocheck_stack_access_within_bounds() as suggested by Andrii. The code isnow simpler and more convincingly tracks the correct maximum stack size.check_stack_range_initialized() can now rely on enough stack having beenallocated for the access; this helps with the fix for the first issue.A few tests were changed to also check the stack depth computation. Theone that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.
Key phrases: bpf
CVE-2023-52453: In the Linux kernel, the following vulnerability has been resolved:hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resumeWhen the optional PRE_COPY support was added to speed up the devicecompatibility check, it failed to update the saving/resuming datapointers based on the fd offset. This results in migration datacorruption and when the device gets started on the destination thefollowing error is reported in some cases,[  478.907684] arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:[  478.913691] arm-smmu-v3 arm-smmu-v3.2.auto:  0x0000310200000010[  478.919603] arm-smmu-v3 arm-smmu-v3.2.auto:  0x000002088000007f[  478.925515] arm-smmu-v3 arm-smmu-v3.2.auto:  0x0000000000000000[  478.931425] arm-smmu-v3 arm-smmu-v3.2.auto:  0x0000000000000000[  478.947552] hisi_zip 0000:31:00.0: qm_axi_rresp [error status=0x1] found[  478.955930] hisi_zip 0000:31:00.0: qm_db_timeout [error status=0x400] found[  478.955944] hisi_zip 0000:31:00.0: qm sq doorbell timeout in function 2
Key phrases: migration datacorruption
CVE-2023-52454: In the Linux kernel, the following vulnerability has been resolved:nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU lengthIf the host sends an H2CData command with an invalid DATAL,the kernel may crash in nvmet_tcp_build_pdu_iovec().Unable to handle kernel NULL pointer dereference atvirtual address 0000000000000000lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp]Call trace:  process_one_work+0x174/0x3c8  worker_thread+0x2d0/0x3e8  kthread+0x104/0x110Fix the bug by raising a fatal error if DATAL isn't coherentwith the packet size.Also, the PDU length should never exceed the MAXH2CDATA parameter whichhas been communicated to the host in nvmet_tcp_handle_icreq().
Key phrases: crash
CVE-2023-52455: In the Linux kernel, the following vulnerability has been resolved:iommu: Don't reserve 0-length IOVA regionWhen the bootloader/firmware doesn't setup the framebuffers, theiraddress and size are 0 in "iommu-addresses" property. If IOVA region isreserved with 0 length, then it ends up corrupting the IOVA rbtree withan entry which has pfn_hi < pfn_lo.If we intend to use display driver in kernel without framebuffer thenit's causing the display IOMMU mappings to fail as entire valid IOVAspace is reserved when address and length are passed as 0.An ideal solution would be firmware removing the "iommu-addresses"property and corresponding "memory-region" if display is not present.But the kernel should be able to handle this by checking for size ofIOVA region and skipping the IOVA reservation if size is 0. Also, adda warning if firmware is requesting 0-length IOVA region reservation.
CVE-2023-52456: In the Linux kernel, the following vulnerability has been resolved:serial: imx: fix tx statemachine deadlockWhen using the serial port as RS485 port, the tx statemachine is used tocontrol the RTS pin to drive the RS485 transceiver TX_EN pin. When theTTY port is closed in the middle of a transmission (for instance duringuserland application crash), imx_uart_shutdown disables the interfaceand disables the Transmission Complete interrupt. afer that,imx_uart_stop_tx bails on an incomplete transmission, to be retriggeredby the TC interrupt. This interrupt is disabled and therefore the txstatemachine never transitions out of SEND. The statemachine is indeadlock now, and the TX_EN remains low, making the interface useless.imx_uart_stop_tx now checks for incomplete transmission AND whether TCinterrupts are enabled before bailing to be retriggered. This makes surethe state machine handling is reached, and is properly set toWAIT_AFTER_SEND.
Key phrases: application crash
CVE-2023-52457: In the Linux kernel, the following vulnerability has been resolved:serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failedReturning an error code from .remove() makes the driver core emit thelittle helpful error message:	remove callback returned a non-zero value. This will be ignored.and then remove the device anyhow. So all resources that were not freedare leaked in this case. Skipping serial8250_unregister_port() has thepotential to keep enough of the UART around to trigger a use-after-free.So replace the error return (and with it the little helpful errormessage) by a more useful error message and continue to cleanup.
Key phrases: use-after-free