generated content from 2024-05-18

objects/vulnerability/vulnerability--0057792b-4499-4aa2-9c73-b1944208b0ab.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--48b1c020-6451-4a36-ba29-4a8eeda8ad00",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0057792b-4499-4aa2-9c73-b1944208b0ab",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:10.191624Z",
+            "modified": "2024-05-18T00:29:10.191624Z",
+            "name": "CVE-2023-39163",
+            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-39163"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0062d37b-f094-4c28-ae2f-95be1b17cab9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8304a486-dee4-42d4-bf38-b071762fa200",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0062d37b-f094-4c28-ae2f-95be1b17cab9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:08.827806Z",
+            "modified": "2024-05-18T00:29:08.827806Z",
+            "name": "CVE-2023-52698",
+            "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: fix memory leak in netlbl_calipso_add_pass()\n\nIf IPv6 support is disabled at boot (ipv6.disable=1),\nthe calipso_init() -> netlbl_calipso_ops_register() function isn't called,\nand the netlbl_calipso_ops_get() function always returns NULL.\nIn this case, the netlbl_calipso_add_pass() function allocates memory\nfor the doi_def variable but doesn't free it with the calipso_doi_free().\n\nBUG: memory leak\nunreferenced object 0xffff888011d68180 (size 64):\n  comm \"syz-executor.1\", pid 10746, jiffies 4295410986 (age 17.928s)\n  hex dump (first 32 bytes):\n    00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<...>] kmalloc include/linux/slab.h:552 [inline]\n    [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]\n    [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111\n    [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739\n    [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n    [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800\n    [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515\n    [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811\n    [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]\n    [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339\n    [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934\n    [<...>] sock_sendmsg_nosec net/socket.c:651 [inline]\n    [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671\n    [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342\n    [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396\n    [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429\n    [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46\n    [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller\n\n[PM: merged via the LSM tree at Jakub Kicinski request]",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-52698"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--01b574ad-2c93-419a-b8b3-aa5bb93f686c.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--6cc1cfa5-7c8f-4a8a-bde3-ca1a0a93262f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--01b574ad-2c93-419a-b8b3-aa5bb93f686c",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:11.730891Z",
+            "modified": "2024-05-18T00:29:11.730891Z",
+            "name": "CVE-2024-27432",
+            "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: fix PPE hanging issue\n\nA patch to resolve an issue was found in MediaTek's GPL-licensed SDK:\nIn the mtk_ppe_stop() function, the PPE scan mode is not disabled before\ndisabling the PPE. This can potentially lead to a hang during the process\nof disabling the PPE.\n\nWithout this patch, the PPE may experience a hang during the reboot test.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-27432"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--01ca7e66-8b97-4570-b493-4e503248f07c.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--52ca76a6-265e-4e92-b03c-48b42f4696d5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--01ca7e66-8b97-4570-b493-4e503248f07c",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:08.702482Z",
+            "modified": "2024-05-18T00:29:08.702482Z",
+            "name": "CVE-2023-46205",
+            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows PHP Local File Inclusion.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.14.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-46205"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--03bbc366-93d5-482a-be8f-ca69d954fa0a.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--90a8ad73-d7e5-414b-9699-c0f705dc61a9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--03bbc366-93d5-482a-be8f-ca69d954fa0a",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:08.939201Z",
+            "modified": "2024-05-18T00:29:08.939201Z",
+            "name": "CVE-2023-32244",
+            "description": "Improper Privilege Management vulnerability in XTemos Woodmart Core allows Privilege Escalation.This issue affects Woodmart Core: from n/a through 1.0.36.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-32244"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--03cef65b-42a9-479b-a070-09d61c5e084e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b911f501-5956-4da7-bbe5-a1215ebdaf59",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--03cef65b-42a9-479b-a070-09d61c5e084e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:11.738274Z",
+            "modified": "2024-05-18T00:29:11.738274Z",
+            "name": "CVE-2024-27971",
+            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Premmerce Premmerce Permalink Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Premmerce Permalink Manager for WooCommerce: from n/a through 2.3.10.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-27971"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--049744e5-850f-47f3-96c5-941c92f8e6a7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7d054541-a36a-43a3-98bd-da4e3bd48638",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--049744e5-850f-47f3-96c5-941c92f8e6a7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:08.777405Z",
+            "modified": "2024-05-18T00:29:08.777405Z",
+            "name": "CVE-2023-52424",
+            "description": "The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an \"SSID Confusion\" issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-52424"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0543ccbd-555b-47b9-824e-92c6133575e6.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e42c83e0-2cd7-4acf-9b04-358e43e7180e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0543ccbd-555b-47b9-824e-92c6133575e6",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:10.158126Z",
+            "modified": "2024-05-18T00:29:10.158126Z",
+            "name": "CVE-2023-24379",
+            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Web-Settler Landing Page Builder – Free Landing Page Templates allows Path Traversal.This issue affects Landing Page Builder – Free Landing Page Templates: from n/a through 3.1.9.9.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-24379"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--05946dda-7037-4829-998d-9d9df10195c6.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--197b1fc4-b1b3-4a46-b6f5-a923db23d922",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--05946dda-7037-4829-998d-9d9df10195c6",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:11.770565Z",
+            "modified": "2024-05-18T00:29:11.770565Z",
+            "name": "CVE-2024-27422",
+            "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout\n\nWe need to protect the reader reading the sysctl value because the\nvalue can be changed concurrently.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-27422"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--07a6ca9a-e998-4557-935d-b6c2db760b71.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c002bd2e-bbb2-4d1d-8770-2b12613fb51f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--07a6ca9a-e998-4557-935d-b6c2db760b71",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:11.870597Z",
+            "modified": "2024-05-18T00:29:11.870597Z",
+            "name": "CVE-2024-23556",
+            "description": "SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability. \n",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-23556"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--085d718f-1058-48b3-8c24-680a728ad0bc.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--54a97dc2-879d-4725-8a51-ffe945f85e5b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--085d718f-1058-48b3-8c24-680a728ad0bc",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:10.688624Z",
+            "modified": "2024-05-18T00:29:10.688624Z",
+            "name": "CVE-2023-25050",
+            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vova Anokhin Shortcodes Ultimate allows Absolute Path Traversal.This issue affects Shortcodes Ultimate: from n/a through 5.12.6.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-25050"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--08612723-9b62-4906-9835-40ae2b430cce.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c5174592-c025-4664-93b7-ceffd9d37384",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--08612723-9b62-4906-9835-40ae2b430cce",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:08.820532Z",
+            "modified": "2024-05-18T00:29:08.820532Z",
+            "name": "CVE-2023-52678",
+            "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c\n\nBefore using list_first_entry, make sure to check that list is not\nempty, if list is empty return -ENODATA.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1347 kfd_create_indirect_link_prop() warn: can 'gpu_link' even be NULL?\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1428 kfd_add_peer_prop() warn: can 'iolink1' even be NULL?\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1433 kfd_add_peer_prop() warn: can 'iolink2' even be NULL?",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-52678"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--09ad4e4d-d54c-4226-abd0-b53fdb5b3cc2.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c768ed15-6b2a-49ae-9174-9e6a4d1765b9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--09ad4e4d-d54c-4226-abd0-b53fdb5b3cc2",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:12.831712Z",
+            "modified": "2024-05-18T00:29:12.831712Z",
+            "name": "CVE-2024-34809",
+            "description": "Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.This issue affects EmpowerWP: from n/a through 1.0.21.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-34809"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0a3943eb-7791-4a35-9d2a-f0a237b47764.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--02146d55-6e22-4585-a27e-ba52ccd58c5e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0a3943eb-7791-4a35-9d2a-f0a237b47764",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:12.118468Z",
+            "modified": "2024-05-18T00:29:12.118468Z",
+            "name": "CVE-2024-35848",
+            "description": "In the Linux kernel, the following vulnerability has been resolved:\n\neeprom: at24: fix memory corruption race condition\n\nIf the eeprom is not accessible, an nvmem device will be registered, the\nread will fail, and the device will be torn down. If another driver\naccesses the nvmem device after the teardown, it will reference\ninvalid memory.\n\nMove the failure point before registering the nvmem device.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-35848"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0ab010a6-3317-4daa-b95a-78c7f486be18.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8ec7da99-cadd-4490-a7ee-bf9faf355cca",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0ab010a6-3317-4daa-b95a-78c7f486be18",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:08.809195Z",
+            "modified": "2024-05-18T00:29:08.809195Z",
+            "name": "CVE-2023-52665",
+            "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2\n\nCommit 8c5fa3b5c4df (\"powerpc/64: Make ELFv2 the default for big-endian\nbuilds\"), merged in Linux-6.5-rc1 changes the calling ABI in a way\nthat is incompatible with the current code for the PS3's LV1 hypervisor\ncalls.\n\nThis change just adds the line '# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set'\nto the ps3_defconfig file so that the PPC64_ELF_ABI_V1 is used.\n\nFixes run time errors like these:\n\n  BUG: Kernel NULL pointer dereference at 0x00000000\n  Faulting instruction address: 0xc000000000047cf0\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  Call Trace:\n  [c0000000023039e0] [c00000000100ebfc] ps3_create_spu+0xc4/0x2b0 (unreliable)\n  [c000000002303ab0] [c00000000100d4c4] create_spu+0xcc/0x3c4\n  [c000000002303b40] [c00000000100eae4] ps3_enumerate_spus+0xa4/0xf8",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-52665"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0c96a5eb-1495-4b6c-849a-a0d431879890.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8aca2b71-707b-410e-b4ba-91e6babb1328",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0c96a5eb-1495-4b6c-849a-a0d431879890",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-05-18T00:29:11.67428Z",
+            "modified": "2024-05-18T00:29:11.67428Z",
+            "name": "CVE-2024-32507",
+            "description": "Improper Privilege Management vulnerability in Hamid Alinia – idehweb Login with phone number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.7.16.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-32507"
+                }
+            ]
+        }
+    ]
+}