CVE Vulnerability Catalog

In the Linux kernel's mac80211 subsystem, a vulnerability exists due to missing validation of extension frame layout before processing. Unsupported extension subtypes can reach code that reads regular headers, potentially leading to improper reads. The fix adds validation and appropriate processing paths for S1G beacon frames.

In the Linux kernel's mchp23k256 driver for MTD, there is an issue with selecting chip capacity data: the driver uses of_device_get_match_data(), which when matched via SPI id table leads to using default data instead of the correct one. The fix changes to spi_get_device_match_data() to use SPI table data when OF data is absent.

In the Linux kernel's NAND driver lpc32xx_slc, there is an issue with DMA timeout handling: lpc32xx_xmit_dma() ignores the result of wait_for_completion_timeout(), causing a timed-out DMA transfer to be reported as successful. The fix returns -ETIMEDOUT and terminates the DMA channel before unmapping the scatterlist.

In the Linux kernel BPF subsystem, the verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. The issue arises because constant offsets were moved to reg->var_off, while __check_buffer_access() only checks the instruction offset. For writable raw tracepoints, an access with a negative offset can wrap the calculated end, allowing a program to bypass validation.

In the Linux kernel, the fwnode_init() function did not initialize all fields of the fwnode_handle structure. If a firmware node is allocated on the stack or heap without zeroing, the secondary pointer may contain uninitialized memory, potentially leading to dereferencing. The fix sets fwnode->secondary to NULL and initializes the remaining fields of the structure.

In the Linux kernel binder module, a vulnerability exists where the LSM context size field is read after being zeroed by release. This inflates the scatter-gather buffer end offset, allowing copies to overwrite the secctx area.

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before version 13.5.7 does not perform an authorization check on one of its REST read routes. This allows unauthenticated users to disclose a store's feed configuration (rules, filters, field mapping) and to enumerate the full product category taxonomy.

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Support Google Consent Mode (GCM)' setting to be enabled.

The MaxUpload plugin for WordPress up to version 1.4.0 is vulnerable to arbitrary file upload via the handle_upload function. Filename validation is inconsistent – extension and MIME checks apply to the uploaded chunk's filename, not to the final assembled filename from the resumableFilename parameter. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

The Propovoice plugin for WordPress up to version 1.7.8 is vulnerable to privilege escalation. The create() function in the REST endpoint fails to validate the role parameter against an allowlist and omits the promote_users capability check, passing the value directly to WP_User::set_role(). Authenticated attackers with ndpv_manager access can create an administrator account.

The Object Sync for Salesforce plugin for WordPress is vulnerable to unauthenticated SQL injection via the wordpress_object_type parameter in the REST route /wp-json/object-sync-for-salesforce/push/. The can_process() function only checks the HTTP method, and the parameter value is directly concatenated into a SQL query. Attackers can inject additional SQL queries, allowing extraction of sensitive data such as password hashes.

The bLoyal plugin for WordPress up to version 3.1.611.78 is vulnerable to privilege escalation. The AJAX actions save_bloyal_configuration_data and save_bloyal_accesskeyverification_data lack capability and nonce checks, and the bloyal_customer_auto_login function unconditionally trusts the Customer.ExternalId value from the API URL. Authenticated attackers with Subscriber-level access can overwrite the API URL and log in as any user, including administrator.

The Online Booking & Scheduling Calendar for WordPress by vcita plugin up to version 4.6.0 is vulnerable to stored cross-site scripting via the business_id parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak".

Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL.