CVE Vulnerability Catalog

In MISP before version 2.4.193, the menu_custom_right_link_html parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks on every page.

In MISP before version 2.4.193, the menu_custom_right_link parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks through a global menu link.

A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API.

In the Linux kernel, an issue was found in the f2fs filesystem where locks are not initialized before use. The f2fs_fill_super() function calls spin_lock on an uninitialized lock, causing a lockdep warning. The fix moves lock and structure initialization to immediately after memory allocation.

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.

A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.

A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash.

A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.

In the Linux kernel, a bug was fixed in the RDMA/mlx5 driver's UMR QP recovery flow. Before transitioning the QP to the RESET state, the software did not wait for all outstanding WRs to complete, which could cause lost CQEs and tasks becoming stuck. The fix adds a final barrier WR before changing the QP state.

In the Linux kernel, the RDMA/mlx5 module has a bug during deregistration of a DM (device memory) type memory region (MR). The code incorrectly takes the wrong branch and attempts to call dma_unmap_single() on a DMA address that is not mapped, resulting in a WARN in iommu_dma_unmap_page(). The issue is resolved by properly accounting for the DM type in mlx5_free_priv_descs().

In the Linux kernel, the RDMA/mlx5 module has a reference count management bug in destroy_unused_implicit_child_mr(). During parent deregistration, the reference count is not properly decremented, causing a task hang for over 120 seconds.

A vulnerability was fixed in the Linux kernel's EFI MOKvar table handling, where the entire table was remapped on each loop iteration during validation. For large tables, this caused a mapping failure and traceback due to early_memmap() limitations. The fix maps only each entry header and enforces NUL termination of variable names.

A flaw was found in Keycloak where JWT tokens used for authentication are cached until expiration. If a client uses JWT tokens with excessively long expiration times (e.g., 24 or 48 hours), the cache can grow indefinitely, leading to an OutOfMemoryError.

Mbed TLS w wersjach przed 2.28.10 oraz 3.x przed 3.6.3 w niektórych przypadkach nieudanej alokacji pamięci lub błędów sprzętowych wykorzystuje niezainicjowaną pamięć stosu do tworzenia wiadomości TLS Finished, co może prowadzić do obejścia uwierzytelnienia, takiego jak ataki powtórzeniowe.

Mbed TLS w wersjach przed 2.28.10 oraz 3.x przed 3.6.3 na stronie klienta akceptuje serwery z zaufanymi certyfikatami dla dowolnych nazw hostów, chyba że aplikacja kliencka TLS wywoła funkcję mbedtls_ssl_set_hostname.

A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. An unknown function of the file /admin-api/infra/file/upload in the Backend File Upload Interface component is affected; manipulation of the path argument leads to path traversal. The attack may be performed remotely, and the exploit is publicly available and might be used. The patch is named 4ae3f6b2c9883978837638c14e3d18419819eeb0.

A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. An unknown function of the file /app-api/infra/file/upload in the Front-End Store Interface component is affected; manipulation of the path argument causes path traversal. The attack can be carried out remotely, and the exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0.

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce channel conversion restrictions. Members with permission to convert public channels to private can also convert private channels to public.

A stack overflow vulnerability was discovered in the Tenda W18E v2.0 running firmware v16.01.0.11, specifically in the wifiSSID parameter at the /goform/setModules endpoint. Attackers can cause a Denial of Service (DoS) by sending a crafted POST request.