CVE Vulnerability Catalog

A chain of vulnerabilities was found in pretix: payment plugins (Stripe, Mollie, OPPWA, BitPay, Payone, SecuConnect, Sofort, Saferpay) do not validate session parameters beyond cryptographic signature, the redirect feature uses the same key and salt for signing as the plugins, and the admin impersonation feature allows changing user after injecting arbitrary parameters. An attacker with access to at least one event can become any backend user and access all data.

The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member.

In the Linux kernel's drm/i915/gem driver, a bug was found in the pread/pwrite functions for physical buffer objects (phys BO). The sg_page() function returns a struct page pointer, not void*, causing incorrect offset scaling during read/write. As a result, with a non-zero offset, wrong parts of the buffer are accessed.

In the Linux kernel for ARM64, a mitigation was added for errata affecting TLBI instructions on certain Arm CPUs. The bug causes a TLBI;DSB sequence to complete before global observation of writes translated by an invalidated TLB entry. Although TLB invalidation is correct, memory access after invalidation may be incomplete.

In the Linux kernel for ARM64 in Rust code, a bug was found related to the LLVM uwtable module flag. Due to a rustc bug, the -Cforce-unwind-tables=y flag does not emit the uwtable annotation for the module, causing compiler-generated functions (e.g., asan.module_ctor) to lack the annotation. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures due to incorrect patching of paciasp/autiasp instructions.

A use-after-free (UAF) vulnerability was found in the Linux kernel's may_decode_fh() function in the fhandle mechanism. The issue arises from reading the mount::mnt_ns field without proper locking, allowing a race condition during unmount and namespace deallocation. The fix adds rcu_read_lock() around the mnt_ns access.

In the Linux kernel's drm/amd/display driver, an out-of-bounds read was found in the dp_get_eq_aux_rd_interval() function. The aux_rd_interval array in struct dc_lttpr_caps has size MAX_REPEATER_CNT - 1 (7 elements), but the offset parameter can be up to MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters. This leads to an out-of-bounds array read.

In the Linux kernel's AMD Display driver (drm/amd/display), dal_vector_reserve() uses uint32_t arithmetic for allocation size, which can wrap and allocate a smaller buffer than expected, leading to heap overflows.

A Race Condition vulnerability in BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.

MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute server paths through error messages.

A vulnerability in MCO allows an authenticated low-privileged user to retrieve administrator access control structures via the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint due to missing authorization checks. This may expose sensitive permission mappings and internal configuration details.

A vulnerability in MCO allows an attacker to lock a victim's account by repeatedly resetting the password. Each reset request invalidates the previous password and temporary passwords, with no limit on the number of resets. An attacker who knows the victim's email and security question answer can effectively deny access to the account.

An IDOR vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint allows unauthorized access to other users' trading documents. The lack of permission validation enables document retrieval based on a guessable identifier.

Vulnerability in @fastify/middie versions 9.1.0 through 9.3.2 causes Node.js process termination when processing malformed percent-encoded sequences in request paths. The issue only affects the standalone engine API (middie.run), not the Fastify plugin path.

The LatePoint plugin for WordPress up to version 5.6.3 is vulnerable to privilege escalation to Administrator due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function and missing role verification in OsAuthHelper::authorize_customer(). An authenticated attacker with Agent-level access can overwrite any customer's email, including one linked to an Administrator account, and then log in as that user.

The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the '_name[]' array parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page.

An OS command injection vulnerability exists in SkyBridge MB-A100/MB-A110 devices. The issue is caused by improper neutralization of special elements used in OS commands.

The DVP80ES3 device contains a vulnerability due to an improperly implemented security check for the standard. This could allow an attacker to bypass security mechanisms.

The DVP80ES3 device has a vulnerability due to improper enforcement of message integrity during transmission in a communication channel. This allows an attacker to modify transmitted data without detection.

The vulnerability in DVP80ES3 involves improper resource shutdown or release, which can lead to memory leaks or other performance issues.