CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the RDS/IB driver causes a NULL pointer dereference in rds_ib_send_cqe_handler() when handling masked atomic completions. The rds_ib_send_unmap_op() function lacks handling for masked atomic opcodes (IB_WR_MASKED_ATOMIC_CMP_AND_SWP and IB_WR_MASKED_ATOMIC_FETCH_AND_ADD), returning NULL and triggering a kernel panic in softirq context.

A NULL pointer dereference vulnerability was found in the Linux kernel's BPF subsystem within bpf_sk_storage_clone and bpf_sk_storage_diag_put_all functions. A concurrent RCU reader can observe a storage element (selem) still on the list after its smap pointer has been cleared by bpf_selem_unlink_nofail(), leading to a crash.

In the Linux kernel, a stack info leak was found in the tap driver via the SIOCGIFHWADDR ioctl. The tap_ioctl() function copies 16 bytes of an uninitialized sockaddr_storage structure to userspace, while netif_get_mac_address() only writes 6 bytes of the MAC address, leaving 8 bytes uninitialized. These 8 bytes may leak sensitive kernel data, including pointers, defeating KASLR.

In the Linux kernel, the jitterentropy crypto mechanism replaced a long-held spinlock with a mutex. Previously, the spinlock was held during expensive entropy generation and SHA3 conditioning, causing CPU stalls for parallel readers.

A vulnerability was found in the Linux kernel's IPC Shared Memory (shm) subsystem. The orphan cleanup function (shm_destroy_orphaned) does not properly synchronize reading the shm_nattch counter with update operations, potentially leading to premature removal of a shared memory segment.

A vulnerability was found in the Linux kernel's AF_UNIX socket implementation. The SIOCATMARK ioctl, which reports the urgent data mark position (MSG_OOB), was accessible for all socket types, even though MSG_OOB is only supported for SOCK_STREAM. For SOCK_DGRAM and SOCK_SEQPACKET sockets, which reject MSG_OOB, the call now returns -EOPNOTSUPP.

In the Linux kernel's batman-adv module, a vulnerability exists where the currently selected gateway pointer is not cleared during mesh teardown, leaving stale state that can break subsequent mesh recreation.

In the Linux kernel VRF subsystem, a potential NULL pointer dereference (NPD) was found when removing a port from a VRF. RCU readers may assume a net device is a VRF port and call l3mdev operations on a new master device (e.g., a bridge) that lacks them, leading to NULL dereference.

In the Linux kernel netfilter/ipset subsystem, a vulnerability was found in IPv4 range iteration for hash:ip,mark, hash:ip,port, hash:ip,port,ip, and hash:ip,port,net sets. The 32-bit iterator may advance past the end of the requested range after processing the last address, causing a later retry to continue from an unintended position.

In the Linux kernel, the batman-adv module is vulnerable to recursive processing of BATADV_UNICAST_FRAG packets. A malicious sender can craft a packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet, causing unbounded recursion and kernel stack exhaustion.

In the Linux kernel, the batman-adv module has a NULL pointer dereference vulnerability. When a network interface is disabled, its mesh_iface pointer is set to NULL, but batadv_v_ogm_send_meshif() may still dispatch OGMv2 packets through the disabled interface, causing a crash due to accessing NULL.

The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.1.2. This is due to missing or incorrect nonce validation on the motordesk_admin_home function.

The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.9. This is due to missing or incorrect nonce validation in the settings_form()/update_settings() functionality.

The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via crafted image src attributes in post content in versions up to and including 5.0.11. This is due to insufficient output escaping in the field() and loop() functions.

The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action.

The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.0.12. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to delete the site's security.txt file or create the .well-known directory.

The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.0.1. Unauthenticated attackers can access sensitive customer data and order details by enumerating sequential order IDs.

The 24liveblog plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the update_lb24_token() AJAX function. Attackers with author-level access can overwrite user meta values and site-wide options of the plugin.

The 24liveblog plugin for WordPress up to version 2.2 exposes sensitive 24liveblog account credentials (API token, refresh token, user ID, and username) to any authenticated user with contributor-level access or higher. This occurs because the lb24_block_enqueue_scripts() function emits these secrets via wp_localize_script() as the lb24BlockData JavaScript object when loading the block editor.

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.2.0. This is due to the get_single_account() REST API callback being registered with a permission_callback that unconditionally returns true, resulting in no authentication or authorization checks on the /devs-accounting/v1/get-account/<id> endpoint.