CVE Vulnerability Catalog

A server-side request forgery vulnerability was found in Umbraco CMS v8.14.1. Attackers can manipulate baseUrl parameters in multiple dashboard and help controller endpoints, such as GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss, to trigger unauthorized server-side requests to external hosts.

An uncontrolled recursion vulnerability was found in libxml2's xmlCatalogXMLResolveURI function. It occurs when an XML catalog contains a delegate URI entry that references itself, leading to infinite recursion and call stack exhaustion.

W oprogramowaniu konfiguracyjnym ThinkPlus zgłoszono potencjalną podatność, która może umożliwić lokalnie uwierzytelnionemu użytkownikowi dostęp do wrażliwych informacji o urządzeniu.

Zgłoszono potencjalną podatność w niektórych pamięciach USB ThinkPlus, która może umożliwić użytkownikowi z fizycznym dostępem do urządzenia odczyt danych przechowywanych na nośniku.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/Editing.php. An authenticated attacker with editing privileges can supply a JavaScript pseudo-protocol (e.g., javascript:) to trigger arbitrary JavaScript execution in the context of the victim's browser session.

An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physical access to execute arbitrary commands with root privileges if the file /opt/images/public_key.der is missing. The vulnerability is triggered by providing a maliciously crafted auth.ini file on the device's SD card.

A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootloader shell via the UART interface. This is achieved by inducing a read error from the SPI flash memory during boot, by shorting a data pin of the IC to ground. An attacker can then dump the entire firmware, leading to the disclosure of sensitive information including cryptographic keys and user configurations.

A global buffer overflow vulnerability in TinyOS up to version 2.1.2 exists in the printfUART formatted output implementation used in the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s specifiers using strcat() without checking remaining capacity, causing writes past the end of debugbuf.

A vulnerability in the AIRTH SMART HOME AQI MONITOR Bootloader v1.005 allows a physically proximate attacker to obtain sensitive information via the open UART port of the BK7231N controller (Wi-Fi and BLE module).

A flaw in vsftpd allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing. A remote, authenticated attacker can crash the server by sending a crafted STAT command with a specific byte sequence.

A bug in the Linux kernel's cpuset subsystem triggers a kernel warning when disabling a remote partition. The issue occurs when a CPU is offlined, causing subpartitions_cpus to be cleared and forcing partitions to share CPUs with the top_cpuset, leading to an inconsistency and a warning that effective_xcpus is not a subset of subpartitions_cpus.

In the Linux kernel, the drm/msm/dpu driver is missing a NULL pointer check for the pingpong interface. The check is almost always performed in dpu_encoder_phys_wb_setup_ctl(), but missing in one place. The fix adds the missing check and uses convenient locals instead of phys_enc->* where available.

In the Linux kernel, md/raid5 has a possible NULL pointer dereference in raid5_store_group_thread_cnt(). When mddev->private is NULL, calling raid5_quiesce() leads to a NULL dereference because conf is reassigned and used without a check.

A flaw was found in the Linux kernel's handling of synthetic events, which lack a function to register perf events. This caused tracepoint registration functions to be called with a NULL function pointer, triggering a kernel WARNING in tracepoint_add_func. The fix returns -ENODEV instead of invoking the unsupported path.

In the Linux kernel, the powerpc/kexec code has an issue when waking offline CPUs with SMT disabled or partially enabled. This triggers a warning and add_cpu failure during kexec preparation.

In the Linux kernel, ACPICA was fixed so that if start_node is NULL, a NULL pointer dereference in acpi_ns_get_next_node() when accessing the parent_node member is avoided. The previous fix did not cover this case, causing crashes on some devices (e.g., Honor Magicbook 14 Pro). The fix moves the start_node NULL check outside the if block.

In the Linux kernel, queue freezing (blk_mq_freeze_queue/blk_mq_unfreeze_queue) was removed from several sysfs store callbacks (io_poll_delay, io_timeout, nomerges, read_ahead_kb, rq_affinity). Freezing the request queue there could cause a deadlock with the dm-multipath driver and the queue_if_no_path option and slowed down system boot. The patch may cause a small delay in applying new settings, but I/O completes correctly regardless of whether the old or new attribute value is used.

In the Linux kernel, the following vulnerability has been resolved: um: init cpu_tasks[] earlier. This is currently done in uml_finishsetup(), but e.g. with KCOV enabled we'll crash because some init code can call into e.g. memparse(), which has coverage annotations, and then the checks in check_kcov_mode() crash because current is NULL. Simply initialize the cpu_tasks[] array statically, which fixes the crash. For the later SMP work, it seems to have not really caused any problems yet, but initialize all of the entries anyway.