CVE Vulnerability Catalog

An XSS vulnerability in the Wikimedia Foundation CheckUser extension allows an attacker to inject malicious scripts into a page. The issue is located in the Vue module file responsible for the temporary account blocking field.

An XSS vulnerability in MediaWiki exists in the ApiSandboxLayout.Js file, allowing an attacker to inject malicious scripts into a page. The issue affects versions from 1.46.0-rc.0 before 1.46.0.

A vulnerability in Poly Voice IP devices (CCX, Trio, Edge E) may render them inoperable when connecting to a malicious SIP server and receiving malformed data. HP is releasing updates to mitigate this risk.

A vulnerability in the Feast Feature Server's `/save-document` endpoint allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Despite location restrictions, these can be bypassed, enabling overwriting of critical application configurations or startup scripts.

Multiple unbounded alloca() calls in the PulseAudio protocol server can lead to stack overflow and potential arbitrary code execution.

The RAOP module accepts unbounded Content-Length values and does not check the return value of pw_array_add().

A chain of vulnerabilities was found in pretix: payment plugins (Stripe, Mollie, OPPWA, BitPay, Payone, SecuConnect, Sofort, Saferpay) do not validate session parameters beyond cryptographic signature, the redirect feature uses the same key and salt for signing as the plugins, and the admin impersonation feature allows changing user after injecting arbitrary parameters. An attacker with access to at least one event can become any backend user and access all data.

A vulnerability in the PrivilegedHelperTool XPC service in Cato Client before version 5.13.1 on macOS is caused by improper certificate validation and a TOCTOU race condition. This allows a local authenticated attacker to escalate privileges to root using a self-signed certificate and a symlink swap during package installation.

The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member.

The PrivateContent WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 9.9.2.

In the Linux kernel's drm/i915/gem driver, a bug was found in the pread/pwrite functions for physical buffer objects (phys BO). The sg_page() function returns a struct page pointer, not void*, causing incorrect offset scaling during read/write. As a result, with a non-zero offset, wrong parts of the buffer are accessed.

Vulnerability in the Linux kernel in the RDS IB driver. During failed connection setup (rds_ib_setup_qp), the i_sends pointer is not cleared after memory free, potentially leading to use-after-free on subsequent shutdown.

In the Linux kernel for ARM64, a mitigation was added for errata affecting TLBI instructions on certain Arm CPUs. The bug causes a TLBI;DSB sequence to complete before global observation of writes translated by an invalidated TLB entry. Although TLB invalidation is correct, memory access after invalidation may be incomplete.

In the Linux kernel for ARM64 in Rust code, a bug was found related to the LLVM uwtable module flag. Due to a rustc bug, the -Cforce-unwind-tables=y flag does not emit the uwtable annotation for the module, causing compiler-generated functions (e.g., asan.module_ctor) to lack the annotation. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures due to incorrect patching of paciasp/autiasp instructions.

A use-after-free (UAF) vulnerability was found in the Linux kernel's may_decode_fh() function in the fhandle mechanism. The issue arises from reading the mount::mnt_ns field without proper locking, allowing a race condition during unmount and namespace deallocation. The fix adds rcu_read_lock() around the mnt_ns access.

In the Linux kernel's drm/amd/display driver, an out-of-bounds read was found in the dp_get_eq_aux_rd_interval() function. The aux_rd_interval array in struct dc_lttpr_caps has size MAX_REPEATER_CNT - 1 (7 elements), but the offset parameter can be up to MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters. This leads to an out-of-bounds array read.

In the Linux kernel's AMD Display driver (drm/amd/display), dal_vector_reserve() uses uint32_t arithmetic for allocation size, which can wrap and allocate a smaller buffer than expected, leading to heap overflows.

The pretix-oppwa plugin insecurely concatenated the resourcePath parameter with the API URL, allowing an attacker to redirect requests to their own server and steal the Oppwa access token. The vulnerability is fixed by strictly validating API URLs.

A vulnerability in allegroai/clearml versions up to 1.16.5 allows relative path traversal when extracting .zip archives using ZipFile.extractall() in StorageManager._extract_to_cache(). Lack of path validation enables arbitrary file writes.

A Race Condition vulnerability in BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.