CVE Vulnerability Catalog

In the Linux kernel, a bug in the btrfs subsystem forces unnecessary reloc root creation during snapshot creation when qgroups (quota) are enabled. This triggers a kernel warning in lookup_inline_extent_backref and flips the filesystem to read-only mode. The issue is reproducible during balance/relocate operations on a btrfs filesystem with quota enabled.

In the Linux kernel's IPVS, there is a bug with reversed argument order in sequence serialization for version 1 sync. This leaves 24 bytes of the message unwritten, potentially disclosing stale heap data and replacing the live connection sequence state with values read from the buffer.

In the Linux kernel, the signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo pointer, so btf_ctx_access() treats it as a trusted pointer for tp_btf programs. However, signal delivery uses SEND_SIG_NOINFO (0) and SEND_SIG_PRIV (1) as special values that are not pointers. A tp_btf program can dereference these values and fault the kernel, and signal_generate can run from timer interrupt context, leading to a kernel panic.

In the Linux kernel, do_wait() passes wo->wo_pid to the sched_process_wait tracepoint, but kernel_wait4() leaves wo_pid NULL for wait4(-1), and kernel_waitid_prepare() does likewise for waitid(P_ALL). btf_ctx_access() types argument 0 as PTR_TO_BTF_ID | PTR_TRUSTED without PTR_MAYBE_NULL, so the verifier accepts an unchecked dereference. Since trusted pointer loads have no fault protection, a wait for any child can cause a NULL pointer dereference in JITed BPF code. The fix marks argument 0 as nullable.

In the Linux kernel, bpf_sys_bpf() and bpf_sys_close() can sleep (e.g., via mutexes, GFP_KERNEL allocations, waiting for an RCU grace period), but they lack .might_sleep on their prototypes. They are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable, but a bpf_timer callback registered by a syscall program is checked in a non-sleepable context. Such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. The fix sets .might_sleep on both prototypes.

In the Linux kernel, the ASoC Intel AVS driver's strace_open() invokes try_module_get(), which on success takes a module reference. If any follow-up operation causes strace_open() to fail, the reference count is not released, resulting in an unbalanced state.

In the Linux kernel, the ASoC Intel AVS driver accesses entries in the init_configs array using indexes from the config_ids array, which are bounded by num_config_ids rather than num_init_configs. Using an ID greater than or equal to num_init_configs leads to an out-of-bounds access in avs_path_module_send_init_configs().

In the Linux kernel, the bcmasp network driver's tx_spb_ring_full() initialized next_index from intf->tx_spb_index on every loop iteration, so incr_ring() always produced the same result and only one slot was ever tested. This caused incorrect checking of consecutive descriptor slot availability before transmission.

In the Linux kernel's BPF subsystem, is_cmpxchg_insn() matches only BPF_MODE == BPF_ATOMIC, so an arena cmpxchg misses the required zero extension for a 32-bit operation. This can lead to incorrect values in the destination register on architectures requiring explicit zero extension.

The Regesta Smart HD-PLC device from Teldat (model TLDPH16D2) with vulnerable firmware version 11.02.06.00.02 is vulnerable to Cross-Site Scripting (XSS). An attacker with network access (registration required) can inject a specific payload via the 'cmdcookie' parameter in /upgrade/index.html.

The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key.

Apache Qpid Broker-J improperly handles compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering. An authenticated message producer can exhaust memory and disrupt broker availability by processing data without a decompressed-output limit.

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold. This allows any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details. This allows unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests. This allows unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as 'code', 'name', and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access.