CVE Catalog

A vulnerability in the Linux kernel's Human Interface Device (HID) core has been identified, specifically related to the handling of Resolution Multipliers. The issue arises because the function 'hid_apply_multiplier()' incorrectly assumes that all Resolution Multiplier controls are within a Logical Collection. This assumption is flawed, as the function can encounter collections that are not Logical, leading to potential errors. The vulnerability was linked to a report from the syzbot fuzzer in 2019, which highlighted these HID core issues.

A vulnerability in the Linux kernel's QCOM SCM driver can lead to a theoretical NULL pointer dereference. This issue arises when the SCM driver fails to properly clean up the global '__scm' variable upon probe failures. External users of the driver, such as those relying on the '__scm->mempool' for TZMEM parts, may assume the probe was successful and encounter a NULL pointer exception. The vulnerability is triggered by introducing probe deferral in the SCM driver, disrupting the expected initialization sequence.

A use-after-free vulnerability has been identified in the Linux kernel's I3C DW master driver. This issue arises from a race condition where the driver's work is scheduled to be processed, but the driver module is removed before the work is completed. The removal process frees the driver's base structure, which is then accessed by the scheduled work, leading to a use-after-free condition. The vulnerability is present in the I3C DW master driver of the Linux kernel.

A memory corruption vulnerability has been identified in the Linux kernel's mailbox implementation for the TH1520 platform. The issue arises in the functions responsible for suspending and resuming interrupt mask registers, where the array designated to store these registers was improperly sized. This miscalculation led to memory corruption by overwriting data when accessing all four interrupt mask registers. The vulnerability has been addressed by resizing the array to correctly accommodate all registers, thereby preventing memory corruption during the suspend and resume processes.

A vulnerability allowing an out-of-bounds read has been identified in the Linux kernel's xfrm state management. This issue arises during the lookup and resize operations, which can execute concurrently. The xfrm_state_hash_generation seqlock is intended to ensure consistency by forcing a retry, but the hash functions can encounter a hmask value that exceeds the capacity of the new hlist array. This inconsistency can lead to improper state lookups, creating a potential for memory access errors.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's USB xHCI (eXtensible Host Controller Interface) component. This issue arises when a command is queued to the last usable Transfer Request Block (TRB) of a ring segment. The enqueue pointer is then moved to the next link TRB, and no further commands can be queued. If this command is later aborted, the handling of the abort completion advances the dequeue pointer to the first TRB of the following segment. If no additional commands are queued, the xhci_handle_stopped_cmd_ring() function detects an inequality in the ring pointers and assumes a command is still pending. This leads to a call to xhci_mod_cmd_timer(), which causes a crash if the current command pointer (cur_cmd) is NULL. The vulnerability has been independently reproduced and confirmed fixed using a USB microcontroller unit (MCU) programmed to indefinitely NAK (negative acknowledgment) the Status stage of the SET_ADDRESS command, preventing several crashes that would have otherwise occurred.

A double free vulnerability has been identified in the UVC video driver of the Linux kernel. This issue arises when the 'uvc_status_init()' function fails to allocate the 'int_urb' buffer. In such cases, the function frees the 'dev->status' pointer but fails to reset it to NULL. Consequently, the subsequent call to 'uvc_status_cleanup()' attempts to double free the memory. The vulnerability has been addressed by modifying the code to reset the 'dev->status' pointer to NULL after freeing it.

A use-after-free vulnerability has been identified in the Linux kernel's PPS (Pulse Per Second) subsystem. This issue occurs when a PPS device is unregistered, leading to a use-after-free condition in the associated character device. The vulnerability was observed on a Raspberry Pi 4 Model B board running NTP daemon (ntpd) and GPS daemon (gpsd). The problem arises because the function that unregisters the PPS device frees the device structure before ensuring that all references to it have been properly handled, allowing for potential memory corruption and exploitation.

A vulnerability has been identified in the Linux kernel's IMX JPEG media component, where an error pointer dereference could occur in the detach_pm() function. The issue arises because an error pointer can be passed to the pm_runtime_suspended() function, leading to a system crash. Although the code checks for error pointers and NULL values, using the IS_ERR_OR_NULL() function would provide clearer validation.

A soft lockup vulnerability has been identified in the Linux kernel's memory cgroup management, specifically during the out-of-memory (OOM) process. When approximately 56,000 tasks were in the OOM cgroup, the system experienced a soft lockup, with CPU#2 reportedly stuck for 23 seconds. This issue arose because the OOM process took a long time to traverse the large number of tasks, leading to a soft lockup. The vulnerability has been addressed by modifying the task scanning process to include periodic rescheduling, and by updating the global OOM handling to prevent soft lockups.

A vulnerability in the Linux kernel's Btrfs file system has been identified, related to improper cleanup of folios when the 'copy-on-write' (COW) operation fails. This issue arises after a failed attempt to run a deferred allocation range, triggering a kernel bug that can lead to a crash. The problem is linked to the error handling of the COW operation, which, under certain conditions, can leave pages dirty and cause a crash by hitting a 'BUG_ON()' assertion. This vulnerability has existed since the introduction of Btrfs.

A vulnerability in the Linux kernel's Btrfs file system has been addressed, related to improper cleanup of folio structures when the 'run_delalloc_nocow' function fails. This issue, which can occur with 'CONFIG_DEBUG_VM' enabled, may lead to a kernel crash. The problem arises during the error handling of 'run_delalloc_nocow', where dirty folios are not properly cleared before unlocking, causing a violation of the folio locking requirements. The vulnerability can trigger a 'VM_BUG_ON_FOLIO' assertion, indicating a serious internal error in the virtual memory management.

A race condition vulnerability has been identified in the Linux kernel's UDP implementation. This issue arises when a UDP socket changes its local address while receiving datagrams, due to a connect() call. There is a brief period during which a lookup operation may fail to locate the socket, after the address change but before the secondary hash and four-tuple hash are updated. This vulnerability affects several Linux kernel versions.

A vulnerability in the Linux kernel's rdma/cxgb4 component could lead to an integer overflow on 32-bit systems. The issue arises because the 'gl->tot_len' variable, which is user-controlled, can be manipulated in a way that causes an integer wrapping bug when added to the sizes of certain headers. This vulnerability has been addressed by using a safer addition method to prevent the overflow.

An integer overflow vulnerability has been identified in the Linux kernel's RTC (Real-Time Clock) driver for the TPS6594 chip, specifically on 32-bit systems. The issue arises in the 'tps6594_rtc_set_offset()' function, where the 'offset' variable, a long integer, is multiplied by 'TICKS_PER_HOUR'. On 32-bit systems, this multiplication can cause an overflow, as the maximum value a long can hold is just over two billion. The 'TICKS_PER_HOUR' constant is significantly large, approximately a hundred million, leading to the overflow when multiplied by certain offset values. The vulnerability has been addressed by changing the data type of 'TICKS_PER_HOUR' to long long, preventing the overflow.

A vulnerability exists in the TP-Link TL-WR845N router, specifically in the versions TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219, due to a hardcoded password for the root account. This password can be extracted by analyzing the firmware, which is available on the manufacturer's public repository, or through a brute force attack via physical access to the router. The vulnerability allows unauthorized users to gain root privileges on the device.

A man-in-the-middle vulnerability has been identified in AdaCore Ada Web Server (AWS) Client version 25.0.0, when it is linked with GnuTLS. The issue arises from insecure default settings that allow for interception of HTTPS communications, as the client does not properly verify the server's certificate unless a specific TLS configuration is applied. This flaw could be exploited to manipulate or eavesdrop on the communication between the client and server.

A vulnerability allowing incorrect access control has been identified in Unifiedtransform version 2.X. This issue enables unauthorized users to access and manipulate endpoints meant solely for administrative purposes, specifically affecting the teacher/edit/{id} endpoint.

A cross-site scripting vulnerability has been identified in CloudClassroom-PHP Project version 1.0. This vulnerability allows remote attackers to execute arbitrary code by exploiting the 'exid' parameter within the 'assessment' function.

A vulnerability exists in Sungrow WiNet-S versions V200.001.00.P025 and earlier, due to the absence of proper integrity checks during firmware updates. This flaw allows an attacker to send a specific MQTT message that triggers the installation of a fraudulent firmware file from an attacker-controlled server onto an inverter or a WiNet connectivity dongle. The exploitation of this vulnerability could lead to unauthorized modifications, control of the device, or potentially bricking it.

A vulnerability allowing Insecure Direct Object References (IDOR) has been identified in the SunGrow iSolarCloud userService API, prior to the October 31, 2024 remediation. This vulnerability enables unauthorized access to sensitive user account data, potentially leading to data leakage and privacy violations.

A vulnerability exists in the Sungrow iSolarCloud Android app in versions through 2.1.6.20241104, where the app fails to properly validate SSL/TLS certificates. This oversight allows for Man-in-the-Middle (MitM) attacks, where an attacker could impersonate the iSolarCloud server and intercept or modify communications between the app and the cloud service, potentially leading to unauthorized access or data manipulation.

A vulnerability allowing Insecure Direct Object References (IDOR) has been identified in the Sungrow iSolarCloud orgService API, prior to the October 31, 2024 remediation. This vulnerability allows attackers to access and modify organizational data without proper authentication, potentially leading to unauthorized changes in organization-wide settings, exposure of sensitive business information, and disruption of services.

A vulnerability exists in the Sungrow iSolarCloud Android application in versions through 2.1.6.20241017, due to hardcoded MQTT credentials. This issue allows interception and manipulation of communication between Sungrow devices and the iSolarCloud platform, potentially leading to unauthorized access to data or control over device telemetry.

A vulnerability allowing Insecure Direct Object References (IDOR) has been identified in the Sungrow iSolarCloud devService API, prior to the October 31, 2024 remediation. This vulnerability enables unauthorized access to device-related data, potentially exposing sensitive information about Sungrow devices and their operational parameters.

A vulnerability allowing Insecure Direct Object References (IDOR) has been identified in the Sungrow iSolarCloud commonService API, prior to the October 31, 2024 remediation. This vulnerability enables unauthorized access to shared system resources, potentially exposing internal service configurations and operational details.

A vulnerability allowing Insecure Direct Object References (IDOR) has been identified in the Sungrow iSolarCloud powerStationService API. This issue could enable unauthorized access to data from other user accounts, potentially revealing sensitive information related to solar power stations. The vulnerability exists in iSolarCloud versions prior to the October 31, 2024 remediation.

A vulnerability exists in the Sungrow iSolarCloud Android app, specifically in versions through 2.1.6.20241017, due to the use of an insecure AES encryption key with insufficient entropy. This weakness may enable attackers to decrypt intercepted communications between the mobile app and the iSolarCloud service, potentially exposing sensitive user information.

A SQL injection vulnerability has been identified in Esri ArcGIS Monitor versions 2023.0 prior to 2024.x, on both Windows and Linux. This vulnerability allows remote, authenticated attackers with low privileges to improperly access limited database schema information by sending crafted queries. While it is possible to enumerate some internal database identifiers, the risk to confidentiality is considered low, as any sensitive data retrieved is encrypted. There is no known impact on integrity or availability.

A command injection vulnerability has been identified in Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode. This vulnerability allows an authenticated, local attacker with valid Administrator credentials to execute arbitrary commands on the underlying operating system of the affected device with root privileges. The issue arises from insufficient validation of certain elements within a software image, enabling an attacker to exploit it by installing a crafted image. Administrators are advised to validate the hash of any software image before installation.

A vulnerability exists in the system file permission management of Cisco Application Policy Infrastructure Controller (APIC). This vulnerability allows an authenticated, local attacker with administrative credentials to overwrite critical system files, potentially leading to a denial-of-service (DoS) condition. The issue arises from a race condition in file handling, which an attacker could exploit by performing specific operations on the file system. Successful exploitation could disrupt the device's normal operation, causing it to enter an inconsistent state and create a DoS condition.

A vulnerability exists in Cisco Application Policy Infrastructure Controller (APIC) that allows an authenticated, local attacker to access sensitive information on an affected device. This issue arises from inadequate masking of sensitive data displayed through system CLI commands. Exploitation of this vulnerability could enable the attacker to gather information that may be used for further attacks.

A command injection vulnerability has been identified in the Command Line Interface (CLI) of Cisco Application Policy Infrastructure Controller (APIC). This vulnerability allows an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of the affected device. The issue arises from insufficient validation of arguments passed to specific CLI commands, enabling attackers to exploit it by injecting crafted input. Successful exploitation could lead to unauthorized command execution with root privileges.

A stored cross-site scripting vulnerability has been identified in the web UI of Cisco Application Policy Infrastructure Controller (APIC). This vulnerability allows an authenticated, remote attacker to inject malicious code into specific pages of the web UI. The issue arises from improper input validation, which could enable the execution of arbitrary script code in the context of the web UI or access to sensitive, browser-based information.

A denial-of-service vulnerability has been identified in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode. This vulnerability allows an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, leading to a denial-of-service condition. The issue arises from the improper handling of specific Ethernet frames. An attacker could exploit this vulnerability by sending a sustained rate of crafted Ethernet frames to the affected device, causing it to reload.

A memory leak vulnerability has been identified in the Quarkus RESTEasy extension. This issue arises when client requests are made with short timeouts, causing buffers to be improperly released. The result is increased memory consumption, which can lead to an application crash due to an OutOfMemoryError.

A vulnerability exists in MET ONE 3400+ instruments running software version 1.0.41, where credentials can be temporarily stored in plain text under rare conditions. This data is not accessible to unauthenticated users.

A SQL injection vulnerability exists in the PHPGurukul Land Record System Project, specifically in version 1.0. The issue is located in the admin add-propertytype.php file, where remote attackers can execute arbitrary code by manipulating the propertytype POST request parameter.

A stack-based buffer overflow vulnerability has been identified in JQ version 1.7.1. The issue arises in the decNumberCopy function within decNumber.c, where NaN is incorrectly treated as a numeric value. This flaw can be exploited by using the --slurp option with a specific filter that includes a crafted digit string containing NaN, leading to an out-of-bounds write. The vulnerability was discovered during fuzz testing and can cause undefined behavior, crashes, or potential security risks.

A stored cross-site scripting vulnerability has been identified in HelpDeskZ versions prior to 2.0.2. This vulnerability allows remote attackers to execute arbitrary JavaScript in the administration panel. The issue arises when a malicious payload is included in the file name of an uploaded file while creating a new ticket.

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Emlog Pro version 2.5.4, specifically within the sort.php component. This vulnerability allows attackers to scan local and internal ports by supplying a crafted URL.

A cross-site scripting (XSS) vulnerability exists in Emlog Pro version 2.5.4. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the title field within the article category section.

A cross-site scripting (XSS) vulnerability exists in Emlog Pro version 2.5.4. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the article header via the admin article management page.

A cross-site scripting (XSS) vulnerability exists in Emlog Pro version 2.5.4. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the postStrVar function within the article_save.php file.

A remote code execution vulnerability has been identified in SeaCMS version 13.3. The issue arises in the admin_files.php component, where inadequate restrictions on file suffixes allow attackers to execute commands with system privileges. This is achieved by writing to the admin_files.htm file and exploiting file inclusion vulnerabilities.

A remote code execution vulnerability has been identified in SeaCMS version 13.3. The issue arises in the admin_ip.php file, where an authenticated attacker can bypass restrictions on edited files. This allows the attacker to inject PHP code, which is then executed with system privileges. The vulnerability exploitation involves manipulating the 'ip' parameter to concatenate and execute arbitrary commands.

An arbitrary file read vulnerability has been identified in SeaCMS version 13.3. The issue arises in the file 'admin_safe_file.php', where the 'file_get_contents' function does not properly validate parameters, allowing attackers to read arbitrary files on the server.

An arbitrary file read vulnerability has been identified in SeaCMS version 13.3. The issue arises in the admin_safe.php file, where the file_get_contents function is used without adequate validation of input parameters. This flaw allows attackers to read arbitrary files from the server.

A remote code execution vulnerability has been identified in SeaCMS version 13.3. The issue arises in the admin_smtp.php component, where an authenticated attacker can bypass file editing restrictions to execute arbitrary commands. This exploitation is possible by injecting PHP code into specific parameters, which is then written to a PHP file that can be accessed and executed on the server.

A remote code execution vulnerability exists in SeaCMS version 13.3 within the admin_template.php file. The issue arises because the file allows path traversal, enabling an attacker to write PHP code into certain file types, which can then be executed on the server.