CVE Vulnerability Catalog

Stack-based buffer overflow vulnerability in the WatchGuard Agent discovery service on Windows. An unauthenticated attacker on the same local network could exploit this to crash the agent service.

FlowiseAI Flowise up to version 3.0.12 contains a vulnerability in the User Controller Handler component where manipulation of the userId/organizationId/workspaceId/email arguments causes authorization bypass. The attack may be initiated remotely.

Stack-based buffer overflow vulnerability in the WatchGuard Agent discovery service on Windows. An unauthenticated attacker on the same local network could exploit this to crash the agent service.

HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access.

HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software.

The vulnerability in HCL BigFix Service Management (SM) involves insufficiently protected credentials for a short duration during communication with a backend internal application. This could allow an attacker to intercept and misuse them if exfiltrated.

A Cross Site Scripting (XSS) vulnerability has been discovered in Juzaweb CMS version 5.0.0. A remote attacker can exploit the Add Banner Ads function to inject a malicious script and execute arbitrary code in the victim's browser.

In the Linux kernel, the APEI/GHES subsystem has a vulnerability where ghes_new() only checks the upper size limit (GHES_ESTATUS_MAX_SIZE) but not the actual allocated memory size. A faulty firmware can send data larger than the allocated buffer, causing an OOPS and potential memory corruption.

A Linux kernel issue was fixed in ceph_zero_partial_object(), which was missing proper snapshot context for its OSD write operations. This could lead to data inconsistencies in snapshots, as demonstrated by a reproducer where the md5sum of a file in a snapshot changed after a fallocate operation. The fix supplies the snapshot context for zeroing operations.

In the Linux kernel, process_metadata_update() in md-cluster blindly dereferences a NULL thread pointer. During MD array startup there is a race window where recv_daemon processes a METADATA_UPDATED message before mddev->thread is initialized, causing a kernel panic.

A Linux kernel issue was fixed in the rtw89 Wi-Fi driver, where fuzz testing revealed that bss_conf->beacon_int might be zero. This could result in a division by zero error in subsequent calculations in the beacon tracking mechanism. The fix sets a default value of 100 TU when the interval is zero.

A Linux kernel issue was fixed in ARM processor CPER record handling, where GHES/CPER logic detected too-small section_length but not too-large values. Malicious or faulty firmware could report a huge section length, causing a dump far beyond the firmware memory-mapped area. The fix adds checks on ERR_INFO_NUM and section_length to prevent going past the buffer.

A Linux kernel issue was fixed in KVM x86, where checking nested events after exiting a blocking state while L2 is active returned -EBUSY. This generated a spurious userspace exit, usually with KVM_EXIT_UNKNOWN, and likely led to the VM's demise. The fix ignores -EBUSY in this path, giving the VM a chance to survive.

In the Linux kernel, of_get_display_timings() in the fbdev subsystem has a refcount leak. of_parse_phandle() returns a device_node with an incremented refcount that is not released via of_node_put() on error paths.

In the Linux kernel, gfs2_fiemap() calls iomap_fiemap() while holding the inode glock, which can cause recursive glock taking if the fiemap buffer is memory-mapped to the same inode and accessing it triggers a page fault.

In the Linux kernel for arm64, support for TSV110 Spectre-BHB mitigation has been added. The TSV110 processor is vulnerable to the Spectre-BHB attack, which can leak information through branch prediction side channels.

A Linux kernel issue was fixed for a missing platform driver data assignment in phy: fsl-imx8mq-usb. The absence of platform_set_drvdata() meant the data was unavailable in the remove() function, potentially causing problems during driver removal. The fix adds the missing driver data assignment.

A vulnerability has been identified in the Linux kernel that has been resolved. In the error path, the function cx88_alsa_dma_unmap() has been added to release resources acquired by cx88_alsa_dma_map().

In the Linux kernel, the wifi libertas driver's usb_tx_block() submits a URB without ensuring the previous transmission has completed, which can trigger a 'URB submitted while active' warning. The fix enforces serialization by calling usb_kill_urb() before submitting a new request.

A Linux kernel issue was fixed in the HID prodikeys driver, where fake USB devices can send their own report descriptors for which the input_mapping() hook is not called. In this case pm->input_ep82 stays NULL, leading to a crash later. The fix checks for the presence of pm->input_ep82 before use.