CVE Vulnerability Catalog

In the Linux kernel, the crypto/ccp driver (sev-dev.c) has a bug where an uninitialized error pointer is dereferenced in __sev_platform_init_locked(). This can lead to unpredictable system behavior.

A vulnerability was discovered in itsourcecode POS Point of Sale System 1.0 involving cross-site scripting in the file /inventory/main/vendors/datatables/unit_testing/templates/empty_table.php. Manipulation of the scripts argument allows remote attack execution. The exploit is publicly available and may be used.

A vulnerability was discovered in itsourcecode POS Point of Sale System 1.0 involving cross-site scripting in the file /inventory/main/vendors/datatables/unit_testing/templates/deferred_table.php. Manipulation of the scripts argument allows remote attack execution. The exploit is publicly available and may be used.

Insufficient parameter sanitization in the TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in loss of platform integrity or denial of service.

Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from a Guest VM to send arbitrary input data, potentially causing a GPU Reset condition.

Improper validation of an array index in AMD Power Management Firmware could allow a privileged attacker to corrupt AGESA memory. This may lead to a loss of integrity.

The Optio Dentistry plugin for WordPress has a Stored XSS vulnerability via the 'optio-lightbox' shortcode in all versions up to and including 2.2, due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts.

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks through TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS session, if one side shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. The CPU is consumed until the overall connection is closed, potentially shutting down a fs2-io powered server. This issue is fixed in versions 2.5.13, 3.12.1, and 3.13.0-M7.

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. Affects versions 6.0 before 6.0.25, 7.0 before 7.0.22, and 8.0 before 8.0.12.

In Keycloak, the account console and other pages accept arbitrary text in the error_description query parameter, which is rendered without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs) displayed within the trusted Keycloak UI.

In the Linux kernel, handling of hwpoisoned large folios in shrink_folio_list was fixed. A race between memory reclaim and memory_failure could cause a kernel panic; such folios are now skipped.

A Linux kernel panic in the 8250 serial driver caused by PSLVERR was fixed. When PSLVERR_RESP_EN is set to 1, reading an empty RBR with FIFO enabled generates an error response, leading to a panic in the serial8250_do_startup() path.

A bug was fixed in the Linux kernel's crypto: caam driver that caused a crash during suspend on iMX8QM and iMX8ULP SoCs. On these SoCs, register page 0 is managed by another core (SECO or Secure Enclave), so accessing it during suspend triggered a synchronous external abort. A new state variable no_page0 was introduced to detect this situation and avoid touching the reserved page.

A use-after-free vulnerability was found in the Linux kernel's QAT (QuickAssist Technology) drivers. Repeated loading/unloading of a device-specific driver (e.g., qat_4xxx) in a tight loop can cause a crash when a power management interrupt fires just before driver unload, leaving a pending work item in the shared `qat_misc_wq` queue. Executing that item after driver removal dereferences freed memory, leading to a kernel panic.

In the Linux kernel on parisc, __get_user() was revised to probe user read access at privilege level 3. Previously, user code could access a read-protected address via a system call.

In the Linux kernel on parisc, gateway LWS calls were revised to probe user read access at privilege level 3. Previously, user code could perform a LWS compare-and-swap on a read-protected address.

In the Linux kernel's media rainshadow-cec driver, a TOCTOU race condition exists in rain_interrupt() where the buffer full check occurs before acquiring the lock. Concurrent interrupts can cause buffer overflow by incrementing buf_len beyond capacity.

In the Linux kernel, the media mt9m114 driver deadlocks when get_frame_interval/set_frame_interval are called via V4L2 subdev pad ops. The driver unnecessarily re-acquires a lock already held by the V4L2 layer.

In the Linux kernel, the venus driver lacks protection against spurious interrupts during probe. Registering the IRQ before handler initialization can lead to a NULL dereference during system boot on Rb3Gen2.

In the Linux kernel media: iris driver, smatch reported a possible NULL pointer dereference because one argument to iris_hfi_gen2_handle_system_error may be NULL. The fix adds a check to validate the argument is not NULL before accessing its members.