CVE Vulnerability Catalog

The Brave Popup Builder plugin up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them, which can lead to Reflected XSS attacks.

A security flaw was discovered in Tenda CH22 1.0.0.1. The function formeditFileName in /goform/editFileName is vulnerable to command injection via the editNameMit argument. The attack can be launched remotely and the exploit has been released publicly.

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.

chirpmyradio CHIRP before commit 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

The Security Hardener plugin for WordPress up to version 2.4.4 is vulnerable to Missing Authorization. The default-enabled user-enumeration protection overwrites permission_callback on /wp/v2/users routes, stripping core capability checks. This allows authenticated attackers with Subscriber-level access to create Administrator accounts or reset existing Administrator passwords.

The PPWP – Password Protect Pages plugin for WordPress up to version 1.9.18 is vulnerable to PHP Object Injection via deserialization of untrusted input from the 'post_protection_roles' parameter. Authenticated attackers with Contributor-level access can inject a PHP Object. No known POP chain exists in the vulnerable software, but if another plugin or theme with a POP chain is installed, further attacks are possible.

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

In the Linux kernel, in the gpio: pca953x driver, the function pca953x_irq_bus_sync_unlock did not hold the i2c_lock during regmap calls, which could lead to incorrect register read/write under concurrent access. A previous patch only protected the write to the interrupt mask register, not the read from the direction register.

In the Linux kernel, in sched_ext, when a sub-scheduler enable fails before scx_link_sched(), the cleanup still runs the full scx_sub_disable(), which can race with root disable and lead to use-after-free. The fix skips the cgroup ownership reset and task walk if the scheduler was never linked.

In the Linux kernel bonding driver (ALB mode), bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing promiscuity on the active slave. In that window the active slave can change, leading to a null-pointer dereference (kernel panic) or an underflow of the promiscuity counter, leaving the interface in IFF_PROMISC.

In the Linux kernel, in the enic driver, enic_remove does not cancel the tx_hang_reset work, which can lead to use-after-free after free_netdev(). The fix uses disable_work_sync() instead of cancel_work_sync() to block re-scheduling of the work.

In the Linux kernel, in IPVS, the function ip_vs_nat_icmp can write out of bounds because the ihl field in the IPv4 header is read multiple times, and a local attacker can modify the packet during processing. The fix reads ihl only once and uses ciph->len as the offset to the transport header.

In the Linux kernel, the amdxdna_insert_pages() function in the accel/amxdna driver has two error paths that incorrectly call vma->vm_ops->close(vma) before returning an error code. This causes premature resource release, and later unmapping by the process leads to a double close and reference count underflow.

In the Linux kernel BPF subsystem, when handling scalar += pointer in adjust_ptr_min_max_vals(), copying only selected fields of pointer state is fragile because pointer provenance is tracked by several bpf_reg_state fields. The fix uses the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state.

In the Linux kernel's mlx5 driver, a vulnerability exists where the firmware tracer creation function can return either NULL or ERR_PTR. The return value is stored without a check, and during core dump generation, an invalid pointer is dereferenced, causing a kernel panic.

A vulnerability in the Linux kernel's BPF conntrack kfuncs was found, where the opts argument can point to a shared map value. Inconsistent reads of the netns_id field during acquisition and release of network namespace references can lead to reference imbalance, potentially destroying a live namespace and crashing the system.

A use-after-free vulnerability was found in the Linux kernel's bpf_iter_tcp_established_batch() for TCP_NEW_SYN_RECV sockets. The request_sock is published on the ehash chain before its refcount is set, and the BPF iterator uses plain sock_hold() instead of refcount_inc_not_zero(), leading to a race that overwrites the refcount and causes use-after-free.

A vulnerability in the Linux kernel's vhost_iotlb mechanism allows IOTLB entries to be allocated beyond the configured limit, leading to uncontrolled memory consumption. Affected components include vhost, vDPA, VDUSE, and vhost-vDPA devices that may create tables with zero or no limits. The fix enforces the limit and rejects invalid values.

A type confusion vulnerability was found in the Linux kernel's hwmon driver for PMBus devices. The pmbus_notify() function incorrectly casts different attribute types to sensor_device_attribute, which may lead to an out-of-bounds read or incorrect mask matching during alerts. The fix changes the attribute structures and sets the index to -1 for attributes that do not trigger notifications.