CVE Vulnerability Catalog

In the Linux kernel, the drm/amd/display driver has an issue where the 'timing generator' pointer (pipe_ctx->stream_res.tg) can be NULL, and dereferencing it leads to a crash. The fix adds a NULL test in dcn21_set_pipe().

A Cross Site Scripting (XSS) vulnerability in Insurance Management System version 1.0.0 and earlier allows a remote attacker to execute arbitrary JavaScript code in the victim's browser via the "First Name" input field.

In the Linux kernel, the sr9800 driver lacks a check for the usbnet_get_endpoints() return value. The error from this function is not propagated, which may lead to incorrect driver behavior.

libcurl built with mbedTLS did not check the server certificate for TLS connections to a host specified as an IP address. The set hostname function was wrongly skipped, completely bypassing certificate verification for HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc.

W bibliotece libcurl występuje luka, która pomija weryfikację certyfikatu dla połączenia QUIC w określonych warunkach, gdy jest zbudowana z użyciem wolfSSL. W przypadku użycia nieznanego lub błędnego szyfru lub krzywej, ścieżka błędu przypadkowo pomija weryfikację i zwraca OK, ignorując problemy z certyfikatem.

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. The leak occurs when the Vert.x HTTP client establishes connections to different hosts, and can be accelerated by an attacker with intimate runtime knowledge. A server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

A flaw in the Linux kernel's ext4 filesystem causes online resizing to fail when the flex_bg parameter is oversized. Attempting to resize a filesystem with an excessive flexbg_size leads to allocation of the new_group_data array exceeding the MAX_ORDER limit, triggering a WARN_ON and failing the operation.

A bug in the Linux kernel's tracing_map mechanism allows CPU reordering of writes, causing sporadic false detection of duplicate histogram entries and a warning in tracing_map_sort_entries. The issue affects multiprocessor systems, particularly AArch64.

A Cross-Site Scripting (XSS) vulnerability exists in dcat-admin version 2.1.3 and earlier. A remote attacker can inject a malicious script via the user login box to execute arbitrary code.

CarrierWave did not fully address CVE-2023-49090. When uploading to object storage (e.g., Amazon S3), it is possible to set a Content-Type value that browsers interpret differently from what content_type_allowlist permits, by providing multiple comma-separated values.

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

A flaw in GnuTLS can cause an application crash when verifying a specially crafted .pem bundle using the 'certtool --verify-chain' command.

Information disclosure vulnerability in Microsoft Edge for Android (Chromium-based). Could allow unauthorized access to data.

An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The module is vulnerable to 'quoted-overlap' zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. Fixed versions reject zip archives which overlap entries.

Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

The Comments Extra Fields For Post, Pages and CPT plugin for WordPress up to version 5.0 is vulnerable to Cross-Site Request Forgery. Several AJAX actions lack nonce validation, allowing unauthenticated attackers to invoke them via a forged request if they trick a site administrator into clicking a link. This can lead to modification of comment form fields and plugin settings.

The Comments Extra Fields For Post, Pages and CPT plugin for WordPress up to version 5.0 is vulnerable to Missing Authorization. Several AJAX actions lack proper capability checks, allowing authenticated attackers with subscriber access or higher to modify comment form fields and update plugin settings.

In the Linux kernel, the nfsd4_release_lockowner() function in the NFS server used an incorrect so_count test that could transiently return a false positive and incorrectly report NFS4ERR_LOCKS_HELD even when no locks were held. This violated the NFS protocol and caused incorrect behavior in the Linux NFS client. The fix restores the use of check_for_locks() in a non-sleeping form.

A flaw was found in Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject specially crafted BFD packets from inside unprivileged workloads, including virtual machines or containers, triggering a denial of service.

In the Linux kernel, a bug in page migration (mm: migrate) can cause a kernel crash due to NULL pointer dereference during concurrent memory hotplug. The issue arises from using the target page's ->mapping field to store an anon_vma pointer without setting the PAGE_MAPPING_ANON flag, leading to incorrect file mapping and a crash in dump_mapping().