CVE Vulnerability Catalog

Notepad++ prior to version 8.9.6.1 contains a vulnerability in handling WM_COPYDATA messages. A local process in the same Windows session can send a malformed message that does not enforce data length checking, potentially leading to a buffer overflow.

Notepad++ versions 8.9.4 through 8.9.6 contain a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without an absolute path after setting the working directory to the contextMenu directory. If an attacker places a malicious powershell.exe in a user-writable installation directory and a privileged user runs the installer selecting that directory, the attacker-controlled executable runs with elevated privileges.

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

The vulnerability in Lansweeper lsrunase 2.0 and lsencrypt 2.0 uses RC4 encryption with a hardcoded 142-byte static key. An 8-character prefix is stored in cleartext alongside the ciphertext, allowing a local attacker to recover any encrypted password to plaintext without brute force.

A vulnerability in the DSO::mmap_and_copy function of relibc (commit 61f42d) allows attackers to cause a Denial of Service (DoS) by loading a crafted shared library.

A vulnerability in the parse_month function (/time/strptime.rs) of relibc (commit ab6a2e) allows an attacker to cause a Denial of Service (DoS) by parsing a crafted input.

HCL Traveler for Microsoft Outlook libraries are being falsely flagged as potentially malicious software or an unrecognized application. This may prevent installation or execution of the software by security systems.

In RustFS version 1.0.0-beta.7 and earlier, the real-time metrics endpoint /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. The validate_admin_request call is missing, allowing restricted users to read sensitive cluster-wide operational data.

In RustFS from version 1.0.0-alpha.1 to 1.0.0-beta.9, when the FTP frontend is enabled, the read and probe handlers (RETR, SIZE, MDTM, CWD) bypass the IAM authorization function, allowing any authenticated FTP user to read and stat any object in any bucket regardless of their IAM policy.

In RustFS versions from 1.0.0-alpha.1 to 1.0.0-beta.9, an authorization bypass was found in the bucket replication admin API. The ListRemoteTargetHandler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket.

In the Linux kernel's MANA network driver, a vulnerability was fixed that caused a race condition when creating debugfs directories. The previous implementation used a hardcoded "0" for Physical Functions (PFs) and pci_slot_name() for Virtual Functions (VFs), leading to a NULL pointer dereference for VFs in environments like VFIO passthrough or nested KVM, as well as name conflicts (-EEXIST errors) when multiple PFs or VFs from different PCI domains were present.

A deadlock was discovered in the Linux kernel's DSA subsystem when using ethtool. The issue is caused by redundant netdev_lock_ops() calls in the DSA wrappers for the conduit device's ethtool operations, leading to a lockup. The bug was reproduced, e.g., when booting qemu with fbnic and CONFIG_NET_DSA_LOOP=y.

In the Linux kernel, a vulnerability in the vfio/pci driver causes DMABUFs not to be cleaned up before the PCI function is disabled during device shutdown. This creates a race window where after clearing the MSE bit, BARs remain accessible via DMABUF.

In the Linux kernel's io_uring/napi subsystem, there was no cap on the maximum polling time when no events were found, which could trigger kernel complaints about a stuck task due to missing conditional rescheduling. A 10 ms limit has been added to prevent this issue.

In the Linux kernel, a vulnerability was found in the nilfs2 filesystem where nilfs_ioctl_mark_blocks_dirty() fails to reject a zero bd_oblocknr value. An attacker can send a crafted ioctl request with bd_oblocknr set to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non-existent block, triggering a WARN_ON(ret == -ENOENT).

In the Linux kernel, the WARN_ON_ONCE in wbt_init_enable_default() was removed because both failure paths (wbt_alloc() returning NULL under memory pressure and wbt_init() returning -EBUSY) are expected. Replaced with plain if-checks and added pr_warn() for diagnostics.

In the Linux kernel, a vulnerability was found in the mt76 driver for mt7925 chipsets, where a NULL pointer dereference could occur in the mt7925_tx_check_aggr() function. The missing NULL check for 'sta' before dereferencing it may lead to a system crash.

In the mt76 Wi-Fi driver for MT7921/MT7922 chipsets, configuring a station with an AID above 20 causes a firmware crash. The issue occurs in AP mode and can be triggered by a modified hostapd version.

A NULL pointer dereference vulnerability was found in the Linux kernel's AMD GPU driver (drm/amd/ras) in the ras_core_ras_interrupt_detected() function. The issue occurs when ras_core is NULL and the code attempts to access the dev field in the error path.

In the Linux kernel, a vulnerability was found in the AMD GPU driver (drm/amd/ras) where the ras_core_get_utc_second_timestamp() function can cause a NULL pointer dereference. The issue occurs when the ras_core pointer is NULL and the function tries to access the dev field in an error message. The patch adds an early NULL check and returns 0 if the pointer is invalid.