CVE Vulnerability Catalog

The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.3.1. This is due to a lack of authentication and authorization checks in the 'handle_checkout_redirecturl_response' function. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by sending a crafted request with a valid order ID.

Avahi in versions 0.9rc2 and below allows crashing avahi-daemon via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record where the alias and canonical name point to the same domain. This causes unbounded recursion in lookup_handle_cname and stack exhaustion. The vulnerability affects record browsers with AVAHI_LOOKUP_USE_MULTICAST explicitly set, including those created by resolvers used by nss-mdns.

A vulnerability in the PHP backend of gemscms.aptsys.com.sg (through May 28, 2025) allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This is achieved by sending specially crafted HTTP GET/POST requests to public API endpoints.

A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg (up to 2025-05-28) allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This is achieved by sending specially crafted HTTP GET/POST requests to public API endpoints.

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can inject malicious HTML or JavaScript into the Name or Description fields, which is stored and later rendered without proper output encoding in search results. When other users view these results, the script executes in their browsers.

A reference count leak was discovered in the Linux kernel's bpf_prog_test_run_xdp() function. The issue occurs when the error handling path fails to call xdp_convert_buff_to_md(), causing a network interface (e.g., sit0) to remain stuck and preventing its release.

In the Linux kernel, the idpf driver frees the RSS LUT during a soft reset and does not restore it unless the interface is up. Running an ethtool command that accesses the RSS LUT immediately after reset causes a NULL pointer dereference and a kernel panic.

In the Linux kernel, in nfsd, attempting to unlock the filesystem via an administrative interface when nfsd is not running crashes the server. This occurs because nfsd4_revoke_states() accesses state structures (e.g., conf_id_hashtbl) that have been freed as part of server shutdown.

In the Linux kernel, the idpf driver has a NULL pointer dereference bug triggered by early ethtool operations such as toggling rxhash before the interface is first brought up. The RSS LUT is not initialized until the interface comes up. The fix moves RSS LUT initialization to vport creation so the LUT is always available.

A crash occurs in the ocelot network driver (Microsemi) when adding an interface to a LAG group. The bug is a NULL pointer dereference in ocelot_set_aggr_pgids() for unregistered ports (ocelot_vsc7514.c frontend).

In the Linux kernel, a bug in the idpf driver's reset handling was fixed. During a hardware or software reset, the driver de-allocated vport resources while network interfaces (netdevs) remained active and exposed to callbacks, potentially causing vport state loss or a kernel crash (NULL pointer dereference) on subsequent ifup/down.

A memory leak in the Linux kernel's skb_segment_list() function used for GRO packet segmentation. The leak stems from outdated truesize accounting after commit ed4cccef64c1 changed fragment orphaning, preventing socket deallocation.

A vulnerability was fixed in the Linux kernel netfilter nf_tables module that could cause CPU soft lockups during chain validation in nft_chain_validate(). The issue stemmed from unnecessary re-validation of the same chains while traversing the rule graph, leading to excessive CPU load.

In the Linux kernel, the net: usb: rtl8150 driver leaks memory when usb_submit_urb() fails in async_set_registers(). The allocated async_req structure and URB are not freed because the completion callback never runs.

W jądrze Linuxa zidentyfikowano podatność związana z wyciekiem pamięci w funkcji 'tpm2_load_cmd'. Problem polega na tym, że tymczasowy obiekt jest alokowany, ale nie jest zwalniany w przypadku błędów.

Podatność CVE-2025-2204 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Tap&Sign firmy Tapandsign Technologies. Umożliwia to ataki typu Cross-Site Scripting (XSS).

The sigstore/sigstore library in versions 1.10.3 and below contains a vulnerability in the legacy TUF client that does not validate whether the target file path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting limited to the permissions of the calling process.

An authentication weakness was identified in Omada Controllers, Gateways and Access Points during device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.

Rekor versions 1.4.3 and below allow SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via a user-provided URL. The SSRF can only trigger GET requests, cannot mutate state, and the response is not returned, so only blind SSRF (internal network probing) is possible.

In Rekor (a software supply chain transparency log) versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing a nil pointer dereference. The validate() function returns nil (success) when the message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error and the service continues, so the availability impact is minimal. This issue has been fixed in version 1.5.0.