CVE Vulnerability Catalog

A copy-paste error in the Linux kernel's audit_log_capset() function causes CAPSET audit records to report the effective capability set in the inheritable field instead of the actual inheritable set. This bug has been present since 2008.

In the Linux kernel, a bug in the AMD Display driver (DCN32) causes a kernel crash when allocating memory for phantom planes. The issue occurs because dcn32_enable_phantom_plane() calls kvzalloc() within a softirq-disabled region, triggering BUG_ON(in_interrupt()).

In the Linux kernel AMD IOMMU driver, a missing bounds check for the device ID (devid) in __rlookup_amd_iommu() caused an out-of-bounds read and a general protection fault (GPF) at boot when a PCI device was not described in the IVRS table.

A vulnerability was found in the Linux kernel's kexec mechanism. After recent changes, in a non-kjump kexec path the return address is no longer pushed onto the stack, causing purgatory code to attempt reading a non-existent address, leading to a fault and potential system hang.

A vulnerability in the Linux kernel's pci_dev_reset_iommu_done() function was found where the IOMMU group domain pointer can be NULL if default domain allocation fails during first probe. This leads to a NULL pointer dereference and system crash when attempting to re-attach the device to the domain.

In the Linux kernel, the gma500 DRM driver for Oaktrail LVDS displays has a bug causing a hang during initialization. The LVDS init code retrieves an I2C adapter via i2c_get_adapter() and on failure attempts to deregister and free also that adapter, which was not allocated by the driver. Since i2c_get_adapter() increments the reference count, the deregistration waits indefinitely for the reference to be released, resulting in a permanent hang.

In the Linux kernel ARM MPAM subsystem, a NULL pointer dereference vulnerability was found in __destroy_component_cfg(). The issue occurs when the function is called from mpam_disable() before the configuration array is allocated, leading to a system crash.

OpenProject before versions 17.3.3 and 17.4.1 has a vulnerability due to unrestricted data-* attributes in <macro> elements in the HTML sanitizer. An attacker can inject data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount a controller that fetches an attacker-uploaded attachment and passes it to renderStreamMessage(), executing arbitrary Turbo Stream actions including redirect_to to an attacker-controlled server.

In OpenProject prior to versions 17.3.3 and 17.4.1, an IDOR vulnerability in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public queries from another project where they lack such permissions.

A vulnerability in OpenProject prior to version 17.4.0 allows disclosure of private work package data from a linked work package belonging to an inaccessible project via a GET request to the API endpoint.

A vulnerability in OpenProject before version 17.4.0 allows an authenticated user to retrieve relations and the subject (title) of work packages they have no permission to view via the GET /api/v3/relations endpoint. The issue stems from a flawed performance optimization in RelationQuery that bypasses the Relation.visible scope.

In OpenProject prior to versions 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for all work packages in a project to any user with the view_shared_work_packages permission. Authorization is performed only at the project level, without verifying that the requesting user can actually view each individual shared work package.

In OpenProject prior to versions 17.3.2 and 17.4.0, a missing authorization vulnerability exists in the CostReportsController. An authenticated attacker can rename, modify filters, and change grouping of any public cost report by knowing its numeric ID, without needing owner permissions.

In OpenProject prior to versions 17.3.2 and 17.4.0, a business logic error in the password change mechanism allows bypassing password strength requirements via a PATCH request to /api/v3/users/me. An attacker with an active session takeover can change a user's password to a weak one.

OpenProject before versions 17.3.2 and 17.4.0 has a vulnerability in the document update endpoint. Attacker-controlled attributes are applied before authorization, allowing a user without :manage_documents permissions to move and modify documents from other projects.

In OpenProject prior to versions 17.3.2 and 17.4.0, the meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name. This allows an attacker to enumerate all existing user accounts by probing user IDs and observing differences in server responses.

OpenProject before version 17.4.0 uses Sanitize::Config::RELAXED[:css] for inline style sanitization in Markdown rendering. This allows authenticated users with write access to inject arbitrary CSS properties in text fields (e.g., work package descriptions, comments).

Patool before version 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12. The vulnerability arises because the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check.

A vulnerability in Nx (versions 17.0.4 through 22.7.2 and 23.0.0-beta.2) occurs because the local HTTP server started by `nx graph` sets the `Access-Control-Allow-Origin: *` header on every response. This allows any website visited by a developer to read the server's responses cross-origin, including the full project graph and the output of the `/help` endpoint, which runs a target's configured help command.

In Envoy from version 1.37.0 to 1.37.5 and 1.38.3, the HTTP OAuth2 filter can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can invoke OAuth2Filter methods on a freed object, causing undefined behavior, worker crashes (availability loss), and use-after-free/invalid-vptr failures. This vulnerability is fixed in 1.37.5 and 1.38.3.