CVE Vulnerability Catalog

In the Linux kernel, nilfs_btree_insert() can cause a NULL pointer dereference when a nilfs2 filesystem has a corrupted b-tree with height greater than 2 and zero child nodes at the root. The fix adds a check in nilfs_btree_root_broken().

A vulnerability was found in the Linux kernel nfsd module where a corrupted main.sqlite file in /var/lib/nfs/nfsdcld/ can cause namelen to be 0. This makes memdup_user() return ZERO_SIZE_PTR, leading to a null pointer dereference in nfs4_client_to_reclaim().

A vulnerability in the Linux kernel exists where the skb pointer is not checked for NULL in tcp_rto_delta_us(). This leads to a NULL pointer dereference in tcp_rearm_rto(), causing a kernel oops and potentially a denial of service. The issue occurs in both the TLP and RACK paths.

Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. This can cause an application crash or potentially remote code execution, though the likelihood of a vulnerable application is low because most protocols use only "named curves" or X9.62 encoding that cannot represent problematic values. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected.

A cross-site scripting (XSS) vulnerability was found in Piwigo version 14.5.0 in the /admin.php?page=photo component. An attacker can inject malicious JavaScript or HTML into the Description field, leading to arbitrary script execution in the victim's browser.

A cross-site scripting (XSS) vulnerability was found in Piwigo version 14.5.0 in the /admin.php?page=album component. An attacker can inject malicious JavaScript or HTML into the Description field, leading to arbitrary script execution in the victim's browser.

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions affected are 9.0.0 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks can result in unauthorized update, insert or delete access and partial denial of service.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions affected are 8.59, 8.60 and 8.61. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).

A symlink traversal vulnerability in the containers/storage library affects Podman, Buildah, and CRI-O. When running a malicious image with an automatically assigned user namespace (--userns=auto), the library reads /etc/passwd inside the container without validating whether it is a symlink, potentially causing the library to read an arbitrary file on the host and leading to a hang and denial of service via OOM kill.

A Remote Code Execution (RCE) vulnerability in ZoneMinder through version 1.36.33 allows an attacker to create a new .php log file in the language folder. By executing a crafted payload, the attacker can escalate privileges and execute arbitrary commands on the remote system.

A directory listing vulnerability in the baserCMS plugin for BurgerEditor and BurgerEditor Limited Edition before version 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of uploaded files.

In the Linux kernel, the spi: hisi-kunpeng driver lacks verification of the max_frequency value provided by firmware. If max_speed_hz is 0, it may cause a division by zero error in hisi_calc_effective_speed().

In the Linux kernel, an integer overflow was fixed in drm/amd/display where the uint8_t ramping_boundary field was assigned 0xFFFF. The value was changed to 0xFF, resolving two INTEGER_OVERFLOW issues reported by Coverity.

In the Linux kernel, a vulnerability in fsnotify regarding lazy clearing of PARENT_WATCHED flags has been resolved. In some setups directories can have many (usually negative) dentries, causing __fsnotify_update_child_dentry_flags() to take significant time under inode->i_lock, leading to lock contention and softlockup reports. The fix sets PARENT_WATCHED flags only when a parent starts watching children, and clears false positive flags lazily in __fsnotify_parent() when watching stops.

Spoofing Vulnerability in Power BI Report Server. An attacker could impersonate a trusted source.

A spoofing vulnerability in Power BI Report Server.

A vulnerability was found in Quarkus CXF where passwords and other secrets may appear in application logs despite user configuration to hide them. This issue requires special configuration such as SOAP logging enabled, application set as client, and endpoint logging properties, and the attacker must have access to the application log.

A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the user's web browser by injecting a crafted payload into the dialog parameter at wrapper_dialog.php.