CVE Catalog

A vulnerability in the Linux kernel's kmemleak subsystem can lead to a warning about sleeping functions being called from an invalid context. This issue occurs under specific conditions: when the kernel is configured with real-time preemption, SELinux is active, kptr_restrict is set to 1, and the kmemleak buffer contains at least one item. The vulnerability arises because the kmemleak sequence reading function attempts to access certain capabilities, which can trigger the 'sleeping function called from invalid context' warning, particularly in real-time preemptive kernels.

A vulnerability in the Linux kernel's memory management system can cause a denial-of-service condition by creating an infinite loop in the 'throttle_direct_reclaim()' function. This issue arises when the 'allow_direct_reclaim(pgdat)' function consistently returns false, causing the system to improperly manage memory zones, particularly under pressure. The problem is exacerbated in systems without swap space, leading to incorrect assessments of memory availability and zone balance. As a result, the kernel can become unresponsive, with tasks stuck in the reclaim process.

A vulnerability in the Linux kernel's handling of hugetlb memory can lead to a page table leak. The issue arises because the folio reference count may be unexpectedly increased by functions like split_huge_pages. This incorrect refcounting can cause the page table to be improperly managed, leading to a 'Bad page state' error. The vulnerability is present in version 6.13.0-rc2 and may be triggered by various processes that increase the reference count of the page table.

A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation has been identified, which can lead to data stream corruption. This issue arises from a bug in the computation of MPTCP option lengths, particularly with the ADD_ADDR option, which can interfere with the previously established DSS option. The vulnerability was reported by Syzbot, highlighting a general protection fault related to non-canonical addresses, indicating a null pointer dereference. The flaw allows for improper handling of TCP options, potentially leading to a privilege escalation.

A use-after-free vulnerability in the Linux kernel's RDMA/SIW component has been addressed. The issue arose from a poorly managed direct link to net_device, which caused a 'KASAN: slab-use-after-free' exception during the siw_query_port() call. The vulnerability has been resolved by removing the direct link and relying on the net_device management of associated ib_devices, thereby eliminating redundant local management.

A vulnerability in the Linux kernel's DRM/XE component can lead to a page fault when userspace closes a file descriptor (fd) after unbinding the device. This issue occurs because the driver attempts to access the hardware while the fd is still open, causing a supervisor read access page fault in kernel mode. The vulnerability has been addressed by ensuring the driver properly manages device access during the fd closure process.

A memory leak vulnerability has been identified in the Linux kernel's TCP connection request processing. When the function 'inet_csk_reqsk_queue_hash_add()' fails, the 'tcp_conn_request()' function exits without releasing the destination memory allocated during the routing request. This oversight leads to unreferenced memory objects, causing a memory leak. The vulnerability was discovered through the kernel memory leak detector, kmemleak.

A vulnerability exists in the Linux kernel's Netrom implementation, specifically within the AX.25 protocol handling. The issue arises from the Netrom route management not properly validating the size of the received buffer before processing it. This oversight can lead to the use of uninitialized data, potentially causing unpredictable behavior or information leakage. The vulnerability was identified by the Linux Verification Center using Syzkaller, a fuzzing tool that discovered the issue while sending raw messages through the IEEE 802.154 implementation.

A use-after-free vulnerability has been identified in the Linux kernel's net/mlx5e component. This issue arises during the driver unload process when unregister_netdev is called after the vport rep has been unloaded. As a result, the mlx5e_rep_priv structure is already freed, leading to attempts to access rpriv->netdev or traverse rpriv->tc_ht', which causes the use-after-free condition. The vulnerability has been addressed by adding checks to ensure that the data of the vport rep is only accessed when it is still loaded.

A slab-use-after-free vulnerability has been identified in the Linux kernel's RDMA/rxe component. This issue arises when a net device is freed while an asynchronous work event is still queued to access it, leading to a use-after-free condition. The vulnerability was discovered during the execution of a workqueue task that processed a cached event for an Infiniband device, after the associated net device had already been unregistered and freed. This flaw allows for memory corruption, which could potentially be exploited to execute arbitrary code or cause a denial-of-service condition.

A vulnerability in the Linux kernel's netfilter component allows for an unaligned atomic read on the 'genmask' field of the 'nft_set_ext' structure. This misalignment can lead to a kernel paging request error, causing a memory access fault. The issue arises from the 'nft_set_ext' structure not being properly aligned to the word size, which is necessary for atomic operations. As a result, accessing certain fields can trigger alignment faults, disrupting normal kernel operations.

A vulnerability in the Linux kernel's NVMe subsystem has been addressed. The issue arose in the 'nvmet_root_discovery_nqn_store' function, which improperly handled the 'subsysnqn' string as a fixed-size buffer. This oversight allowed for a buffer overflow, as the string is dynamically allocated. The vulnerability has been resolved by creating a new string using 'kstrndup', ensuring proper memory management.

A vulnerability in the Linux kernel's WWAN t7xx driver has been addressed, concerning a command timeout issue in the finite state machine (FSM) processing. The driver handles internal state change commands using an asynchronous thread. If the main thread detects a timeout, the asynchronous thread may cause a panic by attempting to execute a completion notification, since the main thread's completion object has already been released. This issue leads to a page fault error, as the system is unable to handle the fault for a specific address, causing a kernel panic.

A vulnerability in the Linux kernel's RDMA/rtrs component could lead to a NULL pointer dereference. This issue arises because the 'ib_sge list' variable was declared within the 'always_invalidate' block, restricting its accessibility. The vulnerability has been addressed by moving the declaration outside the block, ensuring the variable is available for use throughout the function.

A vulnerability allowing sensitive information exposure has been identified in the Elementor Addon Elements plugin for WordPress, affecting all versions through 1.13.10. The issue arises in the 'render' function of the modal-popup widget, where authenticated attackers with Contributor-level access or higher can access private, pending, scheduled, and draft template data.

A vulnerability exists in the FreeIPA API audit process, where the complete FreeIPA command line is sent to journalctl. This behavior unintentionally exposes administrative user credentials, including passwords, to the journal database during the FreeIPA installation. In scenarios where journal logs are centralized, this could lead to unauthorized access to FreeIPA administrator credentials.

A stored cross-site scripting vulnerability has been identified in the PDF for WPForms + Drag and Drop Template Builder plugin for WordPress, affecting all versions through 4.6.0. The vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes, particularly within the yeepdf_dotab shortcode. This flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A vulnerability exists in the NitroPack plugin for WordPress, allowing authenticated attackers with subscriber access or higher to update arbitrary transients. This issue arises from a missing capability check in the nitropack_rml_notification function, present in all versions through 1.17.0. The vulnerability is limited to updating transients with integer values.

A vulnerability exists in the NitroPack plugin for WordPress, in all versions through 1.17.0, allowing unauthorized data modification. This issue arises from a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action. Authenticated attackers with subscriber-level access or higher can exploit this vulnerability to change arbitrary options to a fixed value of '1'. This could activate certain features, such as user registration, or alter options in a way that causes a denial-of-service condition.

A UI spoofing vulnerability has been identified in Google Chrome versions prior to 132.0.6834.83. This issue arises from an inappropriate implementation in the Compositing component, which allows remote attackers to create crafted HTML pages that manipulate the user interface in misleading ways.

A privilege escalation vulnerability has been identified in Google Chrome, specifically in the Navigation component, prior to version 132.0.6834.83. This vulnerability allows remote attackers to escalate privileges by using a specially crafted HTML page. The issue arises from an inappropriate implementation that can be exploited under certain conditions.

A UI spoofing vulnerability has been identified in Google Chrome Extensions, in versions prior to 132.0.6834.83. This issue allows remote attackers to manipulate user interface elements by convincing users to perform specific gestures, using a specially crafted Chrome Extension.

A privilege escalation vulnerability has been identified in the Extensions component of Google Chrome, affecting versions prior to 132.0.6834.83. The issue arises from insufficient data validation, which allowed a remote attacker to exploit specific user interface interactions. By convincing a user to engage in these gestures, the attacker could execute a crafted HTML page that escalated privileges within the browser.

A UI spoofing vulnerability has been identified in the Payments component of Google Chrome, affecting versions prior to 132.0.6834.83. This vulnerability allows remote attackers to manipulate user interface elements by convincing users to perform specific actions, such as clicking or scrolling, on a specially crafted HTML page. As a result, attackers can access sensitive payment-related information saved in the browser, including shipping addresses and contact details.

A vulnerability in Google Chrome's Fenced Frames feature, present in versions prior to 132.0.6834.83, allowed remote attackers to access potentially sensitive information from a user's system through a specially crafted HTML page. This issue arose because the Fenced Frames implementation improperly validated URLs, enabling the loading of local file directories via HTTP or HTTPS.

A UI spoofing vulnerability has been identified in Google Chrome on Windows, in versions prior to 132.0.6834.83. This issue arises from an inappropriate implementation of fullscreen mode, which allows remote attackers to manipulate user interface elements through a specially crafted HTML page.

A race condition vulnerability has been identified in Google Chrome versions prior to 132.0.6834.83. This vulnerability allows remote attackers to perform UI spoofing by convincing users to engage in specific UI gestures on a crafted HTML page. The issue arises from improper handling of frame visibility, which can be exploited to mislead users interacting with certain interface elements.

A stack buffer overflow vulnerability has been identified in the Tracing component of Google Chrome. This issue affects versions prior to 132.0.6834.83. The vulnerability allows remote attackers to potentially exploit stack corruption by using a crafted HTML page. The root cause lies in the 'ProducerSocketConnector::ConnectSocket' function, where an environment variable can be manipulated to overwrite the stack, leading to memory corruption.

A high-severity out-of-bounds read vulnerability has been identified in the Metrics component of Google Chrome. This issue affects versions prior to 132.0.6834.83. The vulnerability allows remote attackers to potentially exploit heap corruption by crafting a malicious HTML page.

A vulnerability in Skia, a graphics library used by Google Chrome, prior to version 132.0.6834.83, allows remote attackers to potentially exploit heap corruption through a crafted HTML page. The issue arises from an integer overflow that can be manipulated to cause out-of-bounds memory access, leading to memory corruption in the GPU process.

A UI spoofing vulnerability has been identified in Google Chrome on Android, in versions prior to 132.0.6834.83. This issue allows remote attackers to manipulate the user interface by hiding the address bar and spoofing the URL display, using a specially crafted HTML page. The vulnerability arises from an improper handling of navigation events, particularly with the 'RenderDocument' feature, which can disrupt the expected sequence of page load notifications. As a result, the address bar can be concealed without user interaction, creating an opportunity for phishing attacks by misrepresenting the actual website being viewed.

A high-severity out-of-bounds memory access vulnerability has been identified in the V8 JavaScript engine of Google Chrome. This issue affects Chrome versions prior to 132.0.6834.83. The vulnerability could allow a remote attacker to exploit heap corruption by sending a crafted HTML page.

A stored cross-site scripting vulnerability has been identified in the MGate 5121, 5122, and 5123 Series, all running firmware version 1.0. This vulnerability arises from inadequate sanitization and encoding of user input in the 'Login Message' feature. An authenticated attacker with administrative privileges can exploit this issue to inject malicious scripts that are persistently stored on the device. These injected scripts are executed when other users visit the login page, potentially leading to unauthorized actions or other consequences, depending on the user's privileges.

A cross-site scripting vulnerability has been identified in Fortinet FortiDeceptor versions 3.x, 4.x, 5.0, 5.1, 5.2.0, and 5.3.0. This vulnerability arises from improper input neutralization during web page generation, allowing attackers to execute reflected cross-site scripting attacks via the recovery endpoints.

A stored cross-site scripting vulnerability has been identified in the Social Proof Testimonials and Reviews by Repuso plugin for WordPress, affecting all versions through 5.20. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'rw_image_badge1' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stored cross-site scripting vulnerability has been identified in the WP Smart TV plugin for WordPress, affecting all versions through 2.1.8. The issue arises from inadequate input sanitization and output escaping on user-supplied attributes in the 'tv-video-player' shortcode. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A reflected cross-site scripting vulnerability has been identified in the Contact Form 7 Redirect & Thank You Page plugin for WordPress, affecting all versions through 1.0.7. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts could be executed if a user is tricked into clicking a link.

A reflected cross-site scripting vulnerability has been identified in the Image Gallery – Responsive Photo Gallery plugin for WordPress, affecting all versions through 1.0.5. The vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the 'awsmgallery' parameter. These scripts could be executed if the attacker successfully persuades a user to click on a manipulated link.

An authentication bypass vulnerability has been identified in Moxa's Ethernet switches, specifically in the EDS-508A Series and various PT switch series, all running specific firmware versions or earlier. This vulnerability arises from flaws in the authorization mechanism, which, despite involving both client-side and back-end server verification, can be exploited by attackers. The weaknesses may allow brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device.

A vulnerability allowing information exposure exists in the Piotnet Addons For Elementor plugin for WordPress, affecting all versions through 2.4.32. The issue arises from the 'pafe-template' shortcode, which lacks proper restrictions on the posts that can be included. This flaw enables authenticated attackers with Contributor-level access or higher to access and extract data from private or draft posts created with Elementor, which they should not be able to view.

A vulnerability in NEC Aterm WX1500HP versions through 1.4.2 and WX3600HP versions through 1.5.3 allows an attacker to execute arbitrary operating system commands over the network.

A vulnerability allowing unauthorized access to critical functions has been identified in several NEC Aterm products, including the WG2600HS, WF1200CRS, WG1200CRS, GB1200PE, WG2600HP4, WG2600HM4, WG2600HS2, WX3000HP, and WX4200D5. In these affected versions, an attacker can retrieve the Wi-Fi password over the network.

A cross-site scripting vulnerability exists in several NEC Aterm router models, including the WG2600HS (through 1.7.2), WG2600HP4 (through 1.4.2), WG2600HM4 (through 1.4.2), WG2600HS2 (through 1.3.2), WX3000HP (through 2.4.2), and WX4200D5 (through 1.2.4). This vulnerability allows an attacker to inject arbitrary scripts via the network.

A denial-of-service vulnerability has been identified in Silicon Labs ZigBee coordinators, routers, and end devices. When these devices receive an unsolicited encrypted rejoin response, they may unintentionally change their node ID. This alteration leads to a denial-of-service condition, causing disruption in the network. To restore normal operation, the network must be re-established.

A denial-of-service vulnerability has been identified in Genivia gSOAP, specifically in versions prior to 2.8.133. When certain options are used with the gSOAP tools 'wsdl2h' or 'soapcpp2', an unauthenticated remote attacker can induce a high CPU load by forcing the parser to process XML files containing duplicate ID attributes. This issue can arise when the software is compiled with specific flags and the resulting application is exposed to crafted XML data.

A stored cross-site scripting vulnerability has been identified in the Event Registration Calendar By vcita plugin for WordPress, affecting all versions through 1.4.0. The issue arises from inadequate input sanitization and output escaping on user-supplied attributes within the plugin's shortcodes. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A stack-based buffer overflow vulnerability has been identified in Linux Ratfor versions through 1.06. This vulnerability allows for arbitrary code execution when the software processes a specially crafted file. Consequently, an attacker could manipulate or access information in the user environment or disrupt its usability.

A stored cross-site scripting vulnerability has been identified in the ViewMedica 9 plugin for WordPress, affecting all versions through 1.4.15. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'viewmedica' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A search injection vulnerability has been identified in Mongoose versions prior to 8.9.5. This issue arises from the improper handling of nested $where filters used in conjunction with the populate() method, allowing for potential search injection attacks.

A Time-of-check Time-of-use (TOCTOU) race condition vulnerability has been identified in Dell Display Manager versions prior to 2.3.2.18. This vulnerability allows a low-privileged attacker with local access to potentially exploit the issue, leading to unauthorized code execution and possibly escalating privileges.