CVE Vulnerability Catalog

In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.

In the Linux kernel, the drm/radeon driver removed the attempt to progress the queue when checking if a fence is signaled. Because signaled() can be called with the fence lock in an unknown state (the fence lock is also the wait queue lock), trying to advance the queue caused a deadlock.

A race condition exists in the Linux kernel between timer_shutdown_sync() and timer expiration. When timer_shutdown_sync() clears the timer function pointer to NULL while the timer is still running on another CPU, a pending timer with a NULL function pointer remains, triggering a WARN_ON in expire_timers(). The fix only clears the timer function when the timer is actually being detached.

A Linux kernel inefficiency in KSM (Kernel Samepage Merging) was fixed. The scan_get_next_rmap_item() function walked every page address in a VMA, which caused high CPU usage by ksmd when scanning large virtual memory areas with mostly unmapped holes. It was replaced with a range walk using walk_page_range() that skips entire unmapped regions.

The Reformer for Elementor WordPress plugin has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects all versions up to and including 1.0.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Stored XSS. This issue affects VK Google Job Posting Manager: from n/a through <= 1.2.22.

The Watu Quiz plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Watu Quiz from n/a through <= 3.4.5.

The Spoter for Elementor plugin (merkulove) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through <= 1.04.

The Yaad Sarig Payment Gateway For WC WordPress plugin versions up to and including 2.2.11 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This could enable unauthorized access to functionality.

Missing Authorization vulnerability in CatFolders (WordPress plugin) in versions up to 2.5.3. Allows exploiting incorrectly configured access control security levels.

Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47.

The Google XML Sitemaps plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.1.22.

Missing Authorization vulnerability in Directory Pro plugin up to version 2.5.6, allowing exploitation of incorrectly configured access control security levels.

The Easy Property Listings plugin by Merv Barrett contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.5.22.

Missing Authorization vulnerability in WP Coupons and Deals plugin up to version 3.2.4, allowing exploitation of incorrectly configured access control security levels.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Freshchat plugin (versions up to and including 2.3.4). The vulnerability allows an attacker to force a logged-in user to perform unwanted actions.

The RTL Tester plugin (up to version 1.2) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an authenticated user into performing unwanted operations.

Missing Authorization vulnerability in WPS Bidouille plugin up to version 1.33.1, allowing exploitation of incorrectly configured access control security levels.

The Quick Interest Slider plugin (versions up to and including 3.1.5) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this to perform unauthorized operations in the context of a logged-in user.

The Listify plugin (up to version 3.2.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can force an authenticated user to perform unwanted actions.