CVE Vulnerability Catalog

In the Linux kernel, a race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash due to an unhandled page fault. The issue is resolved by calling pm_runtime_barrier() after pm_runtime_get_sync() in pci_device_remove(), ensuring that .runtime_idle() completes before driver removal.

A bug in the Linux kernel's ext4 filesystem causes data corruption during online filesystem resize. The issue affects filesystems larger than 16 TiB with 4k block size when resize_inode is disabled, and occurs when resizing across an 8 GiB boundary. During resize2fs, backup block group descriptors may be overwritten, leading to file corruption.

In the Linux kernel dm snapshot module, a lockup occurred when exiting a snapshot with many exceptions because the loop freeing exceptions did not yield the CPU. The fix adds cond_resched() to that loop.

In the Linux kernel, the drm/amd/display driver has an issue when disabling a stream where a function that no longer exists is invoked. The fix checks if the function pointer is NULL before calling it.

In the Linux kernel's drm/amd/display driver, a hang or underflow can occur when transitioning to ODM4:1. Disabling an OPTC and attempting to reclaim its OPP(s) may leave OPPs improperly disconnected, causing a hang or underflow.

A deadlock vulnerability exists in the Linux kernel's btrfs filesystem during fiemap operations. While copying fiemap data to user space, a page fault can occur that tries to acquire the extent lock already held by fiemap, leading to a deadlock. The issue is fixed by not holding the extent lock for the entire duration of fiemap.

In the Linux kernel ALSA usb-audio subsystem, parsing of channel bits continues after all channels are found. If a USB audio device sets more bits than the number of channels, it could write outside of the map array.

A data race exists in the Linux kernel around the sysctl_net_busy_read variable in the netrom subsystem. The sysctl value can be changed concurrently while another thread reads it, without proper synchronization.

In Intel TDX module software before version 1.5.05.46.698, improper input validation may allow a privileged user to potentially enable escalation of privilege via local access.

The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 lacks CSRF check when resetting its settings, allowing an attacker to trick a logged-in admin into resetting them via a CSRF attack.

The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 does not sanitize or escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability that could be used against high-privilege users like admins.

A use of externally-controlled format string vulnerability exists in multiple Fortinet products (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager). An attacker can execute unauthorized code or commands via specially crafted CLI commands and HTTP requests.

Fortinet FortiOS, FortiPAM, and FortiProxy in the listed versions contain a use of externally-controlled format string vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted commands. The vulnerability affects multiple versions of FortiOS (7.4.0, 7.2.0-7.2.5, 7.0, 6.4, 6.2, 6.0.0-6.0.16), FortiPAM (1.1.0, 1.0), and FortiProxy (7.2.0-7.2.5, 7.0.0-7.0.11, 2.0, 1.2, 1.1, and others).

A Cross Site Scripting (XSS) vulnerability in Evertz microsystems MViP-II Firmware 8.6.5 and other products (XPS-EDGE-*, evEDGE-EO-*, MMA10G-*, 570IPG-X19-10G) allows a remote attacker to execute arbitrary code via a crafted payload in login parameters.

A vulnerability has been identified in various versions of SIMATIC automation tools and TIA Portal, allowing for an out of bounds read. This could lead to a Windows operating system crash in the form of a Blue Screen of Death (BSOD).

SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code via a crafted payload to the Login.asp component.

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.

A critical vulnerability was identified in the HTTP server of the most recent Node version, where malformed headers can lead to HTTP request smuggling. Specifically, placing a space before a content-length header causes it to be misinterpreted, enabling attackers to smuggle a second request within the body of the first.

The xmlattr filter in Jinja accepts keys containing characters not allowed in XML/HTML attributes, such as spaces, /, >, or =. If an application accepts keys from user input and renders them on pages seen by other users, an attacker could inject additional attributes and perform XSS.