CVE Vulnerability Catalog

An XSS vulnerability in MediaWiki exists in the ApiSandboxLayout.Js file, allowing an attacker to inject malicious scripts into a page. The issue affects versions from 1.46.0-rc.0 before 1.46.0.

A vulnerability in Poly Voice IP devices (CCX, Trio, Edge E) may render them inoperable when connecting to a malicious SIP server and receiving malformed data. HP is releasing updates to mitigate this risk.

A vulnerability in the Feast Feature Server's `/save-document` endpoint allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Despite location restrictions, these can be bypassed, enabling overwriting of critical application configurations or startup scripts.

Multiple unbounded alloca() calls in the PulseAudio protocol server can lead to stack overflow and potential arbitrary code execution.

The RAOP module accepts unbounded Content-Length values and does not check the return value of pw_array_add().

A chain of vulnerabilities was found in pretix: payment plugins (Stripe, Mollie, OPPWA, BitPay, Payone, SecuConnect, Sofort, Saferpay) do not validate session parameters beyond cryptographic signature, the redirect feature uses the same key and salt for signing as the plugins, and the admin impersonation feature allows changing user after injecting arbitrary parameters. An attacker with access to at least one event can become any backend user and access all data.

A vulnerability in the PrivilegedHelperTool XPC service in Cato Client before version 5.13.1 on macOS is caused by improper certificate validation and a TOCTOU race condition. This allows a local authenticated attacker to escalate privileges to root using a self-signed certificate and a symlink swap during package installation.

The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member.

The PrivateContent WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 9.9.2.

A vulnerability was found in the Linux kernel's DRM driver for Intel i915, affecting physical buffer objects (phys BO). The pread/pwrite functions incorrectly scale the offset because sg_page() returns a struct page pointer, not (void *), causing access to wrong parts of the buffer when a non-zero offset is used.

In the Linux kernel RDS (Reliable Datagram Sockets) subsystem for InfiniBand, a vulnerability exists where the i_sends pointer is not cleared after being freed in the error unwind path during connection setup. This can lead to a use-after-free condition during subsequent connection shutdown.

A vulnerability was found in the Linux kernel for ARM64 architecture, related to errata in Arm CPUs where a TLBI;DSB sequence may complete before global observation of writes translated by an invalidated TLB entry. The issue does not affect TLB invalidation itself but the completion of memory accesses.

In the Linux kernel, the WARN_ONCE() in hsr_addr_is_self() has been removed. The warning was triggered when the HSR node had no self_node pointer set, which can occur during HSR interface deletion. This is a normal condition, not a critical error.

A bug in the Linux kernel's zap_other_threads() function fails to clear JOBCTL_PENDING_MASK for the calling thread during execve(), causing a false pending stop signal and triggering a warning in task_participate_group_stop().

In the Linux kernel, a vulnerability was found in the riscv/ptrace mechanism that triggers a warning during core dump. The issue involves using an incorrect register note type (USER_REGSET_NOTE_TYPE) for REGSET_CFI, potentially causing improper behavior in the elf_core_dump function.

In the Linux kernel, a vulnerability in the wm_adsp driver causes a NULL pointer dereference in wm_adsp_control_remove() when private control data is missing (e.g., for SYSTEM controls or when control_add() callback hides the control). This leads to a crash during firmware control removal.

In the Linux kernel netfilter nf_conntrack, the nf_ct_helper_expectfn_unregister() function fails to remove pending expectations from the table, leaving a dangling pointer to freed module code. When the expected connection arrives after module unload (e.g., nf_nat_h323), calling the stale expectfn pointer causes a system crash (Oops).

In the Linux kernel, a NULL pointer dereference was found in the ASoC SDCA driver during function unregistration. The issue occurs when function registration fails partially or device cleanup races with probe deferral, leaving func_dev entries NULL, causing a kernel oops when device_del() is called on them.

In the Linux kernel, the virtio-gpu driver accesses uninitialized data during driver removal or unbinding when KMS is disabled, causing a kernel crash.

A bug in the Rust compiler causes the -Cforce-unwind-tables=y flag to emit the uwtable annotation only for functions, not for the module. This leads to incorrect DWARF information for KASAN constructors, resulting in boot failures when CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled.