CVE Vulnerability Catalog

In the Linux kernel's veth driver, there is a NAPI leak in the XDP enable error path. The rollback loop skips calling netif_napi_del() for the failed index, leaving a dangling napi_struct in the device's NAPI list, leading to use-after-free (UAF) during device destruction.

In the Linux kernel, the accel/amdxdna driver had a race condition regarding the iommu domain lifetime during device removal. In force_iova mode, accessing xdna->domain after device removal could lead to use-after-free. The fix moves domain freeing to a managed release action, ensuring its validity until all resources are released.

In the Linux kernel, a vulnerability was found in the DRM driver for Intel GPUs (xe). With CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y enabled, xe_pt_svm_userptr_pre_commit() calls vma_check_userptr() with notifier_lock held in read mode, while the test path requires write mode. This triggers an assertion and a WARNING in drm_gpusvm_unmap_pages(), potentially destabilizing the system.

In the Linux kernel, the hid_get_report function in HID core had an out-of-bounds read issue for numbered reports when the data size was 0. The fix moves the minimum size validation before calling hid_get_report, preventing out-of-bounds pointer dereference.

In the Linux kernel, the batman-adv gw module does not reassign the ethernet header pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

In the Linux kernel, the batman-adv batadv_dat_get_vid() function does not verify that the proto field of the ethernet header is accessible before reading it. This could lead to an out-of-bounds read.

In the Linux kernel, the NTFS3 filesystem's decompress_lznt() function does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read.

In the Linux kernel, the ims-pcu driver exposes sysfs attributes on all interfaces, but only supports them on the control interface. Accessing these attributes on data interfaces can lead to unexpected behavior or crashes.

In the Linux kernel, the hwmon asus_atk0110 driver's atk_ec_present() function does not check that the sub-package is non-empty before reading its first element. This can lead to an out-of-bounds read.

In the Linux kernel, a vulnerability was found in the f2fs filesystem's f2fs_listxattr() function. Lack of validation of xattr entries before reading their fields may result in returning a partial result instead of an error when an entry is outside the valid storage area.

A vulnerability in the Linux kernel's IP fragmentation stack allows an attacker to send IP fragments with GSO metadata (e.g., via tun/tap), causing a kernel panic (BUG_ON in skb_segment) after reassembly. It affects IPv4, IPv6, nf_conntrack, and 6lowpan reassembly paths.

The User Registration & Membership WordPress plugin before version 5.2.6 does not perform a capability check when saving its login settings. Authenticated users with plugin management capability but without full administrator access can change arbitrary site options and escalate their privileges to administrator.

The Amelia plugin for WordPress up to version 2.2 is vulnerable to Stored Cross-Site Scripting via customer name fields. An authentication bypass allows unauthenticated users to submit booking data, and in the admin calendar view, customer names are interpolated into JavaScript template literals and rendered via innerHTML without proper HTML entity encoding. An attacker can inject malicious scripts that execute when an administrator hovers over the appointment.

The wpForo Forum plugin for WordPress up to version 2.4.17 is vulnerable to SQL Injection via the 'referer' parameter. Insufficient escaping and lack of preparation on the SQL query allow unauthenticated attackers to append additional SQL queries, which can be used to extract sensitive information from the database.

The Ultimate Member WordPress plugin before version 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list. This allows unauthenticated users who register through the plugin's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.

The shared-files-pro WordPress plugin before version 1.7.70 does not validate the file path supplied when creating a featured image. This allows unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

The User Frontend WordPress plugin before version 4.3.10 does not properly validate field type definitions and deserializes user-controlled post metadata when rendering submitted posts. Users with Editor-level access and above can inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The TranslatePress plugin for WordPress up to version 3.3.3 is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure.