CVE Catalog

A reflected cross-site scripting vulnerability has been identified in the NotFound Private Messages for UserPro WordPress plugin, affecting versions through 4.10.0. This issue arises from improper input sanitization during web page generation, allowing attackers to inject malicious scripts that are executed when users visit the affected page.

A broken access control vulnerability has been identified in the Eniture Technology Standard Box Sizes plugin for WooCommerce, affecting versions through 1.6.13. This vulnerability allows unauthorized users to perform actions that require higher privileges, due to the absence of necessary authorization checks.

A local file inclusion vulnerability has been identified in the NotFound Private Messages for UserPro plugin, affecting versions through 4.10.0. This vulnerability arises from improper control of filenames in include or require statements, allowing for the inclusion of local files on the server.

A stored cross-site scripting vulnerability has been identified in the WordPress Bonjour Bar plugin, affecting versions through 1.0.0. This issue arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A vulnerability exists in the WordPress Poll Maker plugin, specifically in versions prior to 5.5.5, due to improper encoding or escaping of output. This flaw allows for content injection, where a malicious actor could insert their own content into the pages and posts of a WordPress site. Such an injection could be exploited to add phishing pages, for example.

A vulnerability allowing unrestricted upload of files with dangerous types has been identified in the NotFound Fancy Product Designer WordPress plugin, affecting versions through 6.4.3. This arbitrary file upload vulnerability could enable a malicious actor to upload any type of file, including potentially harmful files like backdoors, which could be executed to gain further access to the website.

A privilege escalation vulnerability has been identified in the WordPress Homey Login Register plugin, affecting versions through 2.4.0. This vulnerability allows low-privileged users to escalate their privileges, potentially leading to full control of the website.

A SQL injection vulnerability has been identified in the WordPress Fancy Product Designer plugin, affecting versions through 6.4.3. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing potential exploitation by interacting directly with the database, such as stealing information.

A reflected cross-site scripting vulnerability has been identified in the NotFound ARPrice WordPress plugin, affecting versions through 4.1.3. This issue arises from improper input sanitization during web page generation, allowing attackers to inject malicious scripts that could be executed when users visit the affected site.

A deserialization vulnerability allowing object injection has been identified in the NotFound ARPrice WordPress plugin, affecting versions through 4.1.3. This vulnerability could lead to various injection attacks, including code injection, SQL injection, and PHP object injection, depending on the presence of a suitable payload chain.

A deserialization vulnerability allowing PHP object injection has been identified in the NotFound ARPrice WordPress plugin, affecting versions through 4.1.3. This vulnerability arises from the deserialization of untrusted data, which could potentially lead to various types of code injection, including SQL injection, path traversal, and denial-of-service, if a suitable object injection chain is exploited.

A SQL injection vulnerability has been identified in the NotFound ARPrice WordPress plugin, affecting versions through 4.1.3. This vulnerability allows for improper neutralization of special elements used in SQL commands, potentially enabling attackers to manipulate database queries and interact with the database in unauthorized ways.

A SQL injection vulnerability has been identified in the NotFound ARPrice WordPress plugin, affecting versions through 4.1.3. This vulnerability allows for improper neutralization of special elements used in SQL commands, enabling malicious actors to manipulate database queries and potentially access or modify database information.

A SQL injection vulnerability has been identified in the NotFound Hero Mega Menu - Responsive WordPress Menu Plugin, affecting versions through 1.16.5. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing malicious actors to manipulate database queries and potentially access or modify database information.

A SQL injection vulnerability has been identified in the NotFound Hero Mega Menu - Responsive WordPress Menu Plugin, affecting versions through 1.16.5. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing malicious actors to manipulate database queries and potentially access or modify database information.

A reflected cross-site scripting vulnerability has been identified in the NotFound Hero Mega Menu - Responsive WordPress Menu Plugin, affecting versions through 1.16.5. This vulnerability arises from improper input sanitization during web page generation, allowing attackers to inject malicious scripts that are executed when users visit the affected site.

A privilege escalation vulnerability has been identified in the NotFound Easy Real Estate WordPress plugin, affecting versions through 2.2.6. This vulnerability allows low-privileged users to escalate their privileges, potentially leading to full control of the website.

A vulnerability in the Linux kernel's device mapper thin provisioning module can lead to a general protection fault. This issue arises from the improper use of RCU (Read-Copy-Update) safe list functions, which can cause a thread to access an invalid list entry. The problem occurs when 'list_empty()' sees a valid entry, but 'list_first()' retrieves a different view of the list head after a modification, leading to a crash. The vulnerability has been addressed by changing the list handling to a safer method that reduces the risk of such errors.

A vulnerability exists in the Linux kernel's handling of IOMMU Stream IDs for Nvidia's Tegra MGBE controllers. The driver currently uses a hard-coded Stream ID for all controllers, which can lead to softirq timeouts and kernel panics when using controllers other than the one assigned to MGBE0. This issue has been observed to cause transmission queue timeouts and requires a manual reset of the network adapter.

A vulnerability exists in the Linux kernel's mlx5 driver, specifically in the command handling process. When the function cmd_alloc_index() fails, the cmd_work_handler() does not properly complete the command entry, leading to a situation where the issuing task may hang. This issue can cause a workqueue task to be blocked for an extended period, over 120 seconds in some cases.

A vulnerability in the Linux kernel's GPIO virtuser implementation has been addressed. When a virtuser device is created through configfs and the probing fails due to an incorrect lookup table, the table is not properly removed. This oversight hinders subsequent probing attempts, even after the issue is fixed, unless the device is manually released. Additionally, cleanup is required in the rare event of a platform_device_register_full() failure. This vulnerability also caused a consistent memory leak in the lookup_table->dev_id, which was detected by kmemleak by alternating the live state with a correct lookup table. The introduced function gpio_virtuser_remove_lookup_table() serves as a counterpart to gpio_virtuser_make_lookup_table(), ensuring proper cleanup by being called from all necessary points.

A vulnerability in the Linux kernel's ksmbd component was introduced in version 6.1.0-rc1. The issue arises in the 'ksmbd_vfs_kern_path_locked' function, where an error can cause the function to exit prematurely without restoring the original path buffer. This unaddressed change can lead to incorrect path information being used, potentially allowing for unintended file operations.

A vulnerability in the Linux kernel's netdev component allowed for improper access to NAPI (New API) instances across different network namespaces. NAPI IDs were not fully exposed to user space before the introduction of the netlink API, resulting in a lack of proper namespacing. The netlink API must ensure that NAPI instances are accessed only within the same network namespace as the owning generic netlink socket. This vulnerability has been addressed by making the NAPI ID access static, although it requires relocation due to dependencies on the device retrieval function by NAPI ID.

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Btrfs file system. This issue arises during the scrub operation, which is intended to check the integrity of data and metadata. The vulnerability occurs when the extent tree, crucial for the scrub process, is corrupted. As a result, the scrub operation attempts to access a NULL pointer, leading to a kernel crash. The vulnerability affects Linux kernel versions through 6.13.0-rc4.

A vulnerability in the Linux kernel's scheduler has been addressed by modifying the locking mechanism in the SCX operations bypass function. Previously, the function used rq_lock() to acquire locks while iterating through CPUs, which could lead to warnings if a CPU was offline or handling a task in a higher scheduler class, such as deadline. The rq_lock() is intended for online CPUs only. The change to raw_spin_rq_lock() prevents these unnecessary warnings and aligns the locking behavior with the CPU's state.

A vulnerability in the Linux kernel's hwmon (drivetemp) driver has been addressed. The issue arose because the driver incorrectly handled error codes from the 'scsi_execute_cmd()' function, which can return both negative Linux error codes and positive SCSI command result codes. The driver passed these positive error codes directly to the hwmon core, which only interprets negative codes as errors. This mismanagement led to hwmon displaying uninitialized data to userspace when SCSI errors occurred, such as when a disk drive was disconnected. The patch now correctly interprets positive error codes as SCSI errors and returns a negative error code, ensuring proper data handling.

A vulnerability in the Linux kernel's virtio-block component relates to improper queue management during system suspend. The issue arises because the component replaces the queue quiesce method with a freeze method in its power management callbacks. While the freeze method is intended to pause operations and drain in-flight I/Os before suspension, it can inadvertently cause deadlocks. This occurs because freezing the queue in the current context can block attempts to enter the I/O processing queue, leading to a deadlock situation. The problem was highlighted by a lock dependency warning related to the virtio-block's queue freeze operation.

A vulnerability in the Linux kernel's RISC-V architecture has been addressed, concerning an out-of-bounds issue in the vmemmap address calculation. In the sparse vmemmap model, the virtual address for vmemmap is derived from the VMEMMAP_START and the physical RAM base. However, the kernel initializes struct pages starting from the first page in the same section as the physical RAM base. If this first page's physical address does not align with the expected value, the calculated virtual address can fall below VMEMMAP_START, leading to an out-of-bounds condition. This vulnerability could cause issues during the initialization of unavailable memory ranges by misaligning the virtual addresses of certain struct pages.

A vulnerability in the Linux kernel's IIO ADC subsystem for the TI ADS1298 device has been addressed. The issue was a potential NULL pointer dereference because the function 'ads1298_initdevm_kasprintf()' could return NULL on failure, and this return value was not properly checked in 'ads1298_init()'. The vulnerability has been resolved by adding the necessary NULL check.

A vulnerability in the Linux kernel's exFAT file system implementation has been addressed. The issue arose because buffers marked as new were not properly zeroed before being written. This oversight could lead to uninitialized data in the page cache being inadvertently written. The vulnerability has been resolved by ensuring that new buffers are zeroed before the write operation.

A vulnerability in the Linux kernel's netfs component when handling Ceph filesystems has been addressed. The issue arose in the 'netfs_unlock_read_folio()' function, where folios are prepared for caching by marking them dirty or setting their private data. After unlocking, the folio_queue entry is cleared, creating a problem for 'netfs_pgpriv2_write_to_the_cache()', which relies on this queue to locate folios for caching. This flaw could lead to a system hang. The vulnerability could be reproduced by starting cachefiles, mounting a Ceph filesystem with the 'fsc' option, and writing to it.

A vulnerability in the Linux kernel's netfs component affects the handling of cache for files when using the deprecated PG_private_2 method, as seen with Ceph. When direct I/O writes disable caching for a file, future cache copying is halted until all file descriptors are closed. However, if netfs_lib attempts to copy to the cache while caching is disabled, the operation fails without properly managing the request. This oversight causes requests to be discarded, leaving associated folios in an inconsistent state. The vulnerability was identified by running a specific xfstest against Ceph with an active cache and the 'fsc' option, which typically causes a hang.

An infinite loop vulnerability has been identified in the Linux kernel's exFAT file system implementation, specifically within the 'exfat_readdir()' function. This issue arises when a corrupted file system creates a cluster that links to itself, leaving an unused directory entry. In such cases, the 'dentry' variable fails to increment, allowing the condition 'dentry < max_dentries' to bypass the loop, leading to an infinite iteration. Consequently, the 's_lock' is not released, causing other tasks, like 'exfat_sync_fs()', to hang. The vulnerability affects several versions of the Linux kernel that include the flawed exFAT implementation.

A vulnerability exists in the Linux kernel for RISC-V architecture, where the 'die()' function can be called within an exception handler context that does not allow sleeping. The 'die()' function, however, takes a spinlock that can sleep when PREEMPT_RT is enabled, leading to a warning about sleeping functions being called from an invalid context. This issue was resolved by switching to a raw spinlock, which does not sleep even with PREEMPT_RT enabled.

An input validation vulnerability has been identified in Qualifio's Wheel of Fortune. This issue allows an attacker to manipulate an email address by adding a ‘+’ symbol, enabling repeated access to the application and the ability to win prizes multiple times.

An input validation vulnerability has been identified in Qualifio's Wheel of Fortune. This issue allows an attacker to manipulate an email address by altering the case of the characters. Such modification could enable repeated access to the application, facilitating the unauthorized winning of prizes.

An integer overflow vulnerability has been identified in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The issue arises in the 'sctp_association_init()' function, where the 'max_autoclose' parameter can be set to an excessively high value, leading to an overflow condition. By default, 'max_autoclose' is set to INT_MAX divided by HZ, but it can be manually adjusted to UINT_MAX. This vulnerability allows for unintended behavior in the autoclose mechanism of SCTP associations.

A vulnerability in the Linux kernel's RDMA/bnxt_re component has been addressed, concerning the maximum number of scatter-gather elements (SGEs) for Work Requests. The P7 version currently supports up to 13 SGEs, but the Work Queue Entry (WQE) software structure can only accommodate 6. This mismatch allows the stack to process requests with up to 13 SGEs, leading to traffic failures and system crashes. The vulnerability arose because the maximum SGE limit was not properly defined for variable-sized WQEs, causing issues for both static and variable WQEs.

A vulnerability in the Linux kernel's RDMA/hns component was introduced when an invalid dip_ctx pointer was accessed during the destruction of a Queue Pair (QP). This issue arises if the QP modification to the Ready-to-Receive (RTR) state fails, leaving the dip_ctx uninitialized. Consequently, the destruction process attempts to access a non-existent context, leading to potential instability or undefined behavior.

A vulnerability in the Linux kernel's function graph tracer can lead to a NULL pointer dereference. This issue arises in the '__ftrace_return_to_handler()' function, where a loop iterates over 'fgraph_array[]' elements, checking for 'fgraph_stub' to prevent its use afterward. However, if the compiler reloads 'fgraph_array[]' after this check, it may introduce a 'fgraph_stub' that the loop processes. Since the stub's 'func_hash' field is null, this leads to a NULL pointer dereference. To address this, a 'READ_ONCE()' was added when accessing 'fgraph_array[]', ensuring that the comparison against 'fgraph_stub' matches the processed 'gops' later.

A vulnerability in the Linux kernel's GVE driver related to the management of eXtra Socket (XSK) pools has been addressed. The issue arose because the enabling and disabling of XSK pools did not account for the existence of receive (RX) queues. If an interface was down, this oversight could lead to a crash, as the RX queue pointer would be NULL. The vulnerability has been resolved by ensuring that XSK pool registration occurs only when the interface is active. Additionally, the xsk_wakeup function has been modified to check for the availability of queues, preventing potential crashes when queues are removed while the function is running.

A vulnerability in the Linux kernel's GVE driver related to the management of XDP (eXpress Data Path) queues has been addressed. Dedicated XDP queues are only available when an XDP program is active and the interface is operational. The NDO (Network Device Operations) XDP XMIT callback should bypass execution if these conditions are not met. If no XDP program is loaded, the XDP queue count is zero, potentially leading to a divide-by-zero error. Conversely, if the interface is down, the queue count remains unchanged to preserve the XDP queue information for the next time the interface is active, but the transmission pointer becomes null. Additionally, the XDP transmission callback must coordinate with the device's transition from open to closed, using the GVE_PRIV_FLAGS_NAPI_ENABLED flag and a synchronize_net() call to ensure that any RCU (Read-Copy-Update) critical sections are completed before proceeding.

A vulnerability in the Linux kernel's SELinux implementation has been addressed. The issue involved the evaluation of extended permissions, where unknown permissions were improperly handled by triggering a BUG() call. This vulnerability could disrupt the addition of future permissions in older kernel versions. The fix ensures that unknown permissions are ignored, allowing for smoother updates without compatibility issues.

A vulnerability in the Linux kernel's tracing subsystem has been addressed. The issue arose in the process_string() function, which processes strings for TRACE_EVENT() TP_fast_assign() macros. These macros could inadvertently assign a pointer to a dynamically allocated string to the ring buffer, and later reference it in TP_printk() format, potentially leading to the use of a freed string. To mitigate this, the test_event_printk() function was introduced to verify that string references in TP_printk() are safe, but it may produce false positives. For example, the xe_bo_move() event was incorrectly flagged because it referenced an array of pointers that should have been considered safe.

A stored cross-site scripting vulnerability has been identified in the Betheme plugin for WordPress, affecting all versions through 27.6.1. The issue arises from inadequate input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages. These scripts would execute when a user views the affected page.

A denial-of-service vulnerability has been identified in Elastic Kibana versions prior to 7.17.23 and 8.14.2. The issue arises from an unlimited allocation of resources in response to certain requests, specifically to the '/api/log_entries/summary' endpoint. This vulnerability can be exploited by users with read access to the Observability-Logs feature, potentially leading to a crash of the Kibana instance.

A resource allocation vulnerability without proper limits or throttling has been identified in Elasticsearch. This issue is present in versions prior to 7.17.21 and prior to 8.13.3. When exploited through a specially crafted query using an SQL function, the vulnerability can cause an OutOfMemoryError exception, leading to a crash.

A vulnerability exists in Elastic Defend on Windows systems, where improper handling of multibyte character encoding can lead to an uncaught exception. This exception causes Elastic Defend to crash, preventing the application from quarantining files or terminating processes as needed. The issue affects versions of Elastic Defend prior to 8.13.3.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the wp-greet plugin for WordPress, affecting all versions through 6.2. The vulnerability arises from inadequate nonce validation, allowing unauthenticated attackers to manipulate settings and inject malicious scripts by tricking an administrator into clicking a link.

A stored cross-site scripting vulnerability has been identified in the FireCask Like & Share Button plugin for WordPress, affecting all versions through 1.2. The issue arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts are executed when users access the affected pages.