CVE Vulnerability Catalog

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before version 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check. This allows unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.

Vulnerability allowing external parties to access files and directories in Microsoft Edge (Chromium-based). An unauthorized attacker can disclose information over a network.

Origin validation error in Microsoft Edge (Chromium-based). An unauthorized attacker can disclose information over a network.

NoteGen before version 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments by default. JavaScript in the application webview can invoke plugin:shell|execute to run attacker-controlled OS commands with NoteGen process privileges.

NoteGen before version 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML without HTML sanitization and with CSP set to null. Attacker-controlled content can cause the model response to include executable markup, leading to XSS in the application context.

In the Linux kernel, the next hop weight was increased from 8 bits to 16 bits to support larger ECMP weight ratios in CLOS networks. The change repurposed the reserved field resvd1 in the nexthop_grp structure to store high-order weight bits.

The datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability. Attackers controlling input schemas can achieve remote code execution by supplying a malicious customBasePath value with embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

The Fluent Forms Pro Add On Pack plugin for WordPress up to version 6.2.6 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with Subscriber-level access or above can inject a PHP Object. The presence of a POP chain allows changing user passwords and potentially taking over administrator accounts. Exploitation is only possible if user update integration is enabled and a user meta field is mapped.

In the Linux kernel, the unused character device and IOCTLs in the QAT driver have been removed, reducing the attack surface. Device management is already handled via sysfs.

In the Linux kernel DRM Hyper-V driver, the resolution_count field in SYNTHVID_RESOLUTION_RESPONSE was not validated, potentially causing an out-of-bounds read of the supported_resolution array. Also, when the WIN10 resolution probe failed, screen_*_max / preferred_* were left unset, causing all userspace framebuffers to be rejected.

In the mlx5e driver in the Linux kernel, during handling of temporary SAs (acquire SA) in IPsec, the eswitch mode block was skipped, but the success label called unblock, causing an underflow of the num_block_mode counter.

In the arm_ffa firmware in the Linux kernel, the register-based PARTITION_INFO_GET_REGS path trusted firmware-provided indices, potentially allowing writes past the allocated array when copying partition descriptors.

In the DRM AMDGPU driver in the Linux kernel, for VCE 1, the VCPU BO size did not account for the offset where the firmware resides, potentially causing an out-of-bounds read. Also, stack and data were not aligned to the 32K TLB size, and firmware was not checked to fit in the reserved space.

In the Linux kernel mac80211 subsystem, the MLE (Multi-Link Element) defragmentation routine was called with a pointer to the defragmented copy but the original elements, potentially causing a heap over-read if the original frame was at a higher address.

In the Linux kernel, a use-after-free vulnerability was found in the ACPI NFIT driver. The error cleanup in acpi_nfit_init() fails to remove the acpi_desc object from the acpi_descs list, leading to a dangling pointer that can be accessed during subsequent Machine Check Exceptions (MCE), causing a use-after-free condition.

In the Linux kernel, the ad_sigma_delta driver for registerless ADC devices (has_registers=false) without rdy_gpiod, the ad_sigma_delta_clear_pending_event() function may read conversion data instead of status, corrupting the data stream. Additionally, when num_resetclks=0, a memset with negative size causes a heap overflow.

In the ad_sigma_delta ADC driver in the Linux kernel, issues were found with CS (chip select) being left asserted and SPI bus lock state leaks. In ad_sigma_delta_single_conversion(), set_mode() and disable_one() are called while keep_cs_asserted is still true, leaving CS active after conversion. Additionally, in the error path of ad_sd_buffer_postenable(), the device may remain in continuous conversion mode with CS asserted, and the bus_locked flag may stay set, allowing concurrent SPI access.

A race condition in the Linux kernel's IIO event FIFO reset allows a concurrent thread to read from the FIFO during reset, causing an out-of-bounds read and kernel memory leak to userspace.

In the ALSA virtio-snd driver, control metadata from the device is not validated, allowing a malicious device to cause out-of-bounds access.