CVE Vulnerability Catalog

Missing checks in certain functions related to RMP initialization allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity.

In the Linux kernel, a page fault occurs in the vfio/xe driver when resetting VF devices that do not support migration. The fix reorganizes initialization to decouple migration from reset.

The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.

A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.

In glibc 2.15, a bug was introduced in the nscd daemon that causes a null pointer dereference when a not-found netgroup response is not added to the cache. This leads to a crash of nscd.

A vulnerability in the Nodemailer library allows header injection via the `list.*.comment` field, which is not sanitized for CR (`\r`) and LF (`\n`) characters. An attacker can supply a malicious value in this field, leading to email header spoofing.

A vulnerability in Nodemailer allows bypassing the `disableFileAccess` and `disableUrlAccess` options when using `jsonTransport`. While the normal MIME streaming path enforces these restrictions, `jsonTransport` serializes the message in a way that bypasses them, potentially enabling access to local files or external URLs.

The html/template package in Go improperly handles HTML-like "" and hashbang "#!" comment tokens within <script> contexts. This can cause the template parser to misinterpret script contents, leading to improper escaping of actions.

The html/template package in Go improperly applies rules for handling "<script", "<!--", and "</script" sequences within JS literals in <script> contexts. This may cause the template parser to prematurely terminate script contexts, leading to improper escaping of actions.

When parsing a multipart form in Go, limits on the total form size were not applied to memory consumed while reading a single form line. This allows an attacker to send a malicious request causing excessive memory consumption.

A vulnerability in Go's crypto/tls library causes a panic when verifying a certificate chain containing a certificate with an unknown public key algorithm. This affects all TLS clients and servers with client certificate verification enabled.

The vulnerability in the os.OpenFile implementation in Go causes different behavior on Unix and Windows systems when the target path is a dangling symlink. On Unix, the O_EXCL flag prevents following symlinks, while on Windows the function may follow the symlink to a nonexistent location.

A vulnerability in the LookPath function causes that when the PATH environment variable contains paths to executable files (rather than just directories), passing certain strings ("", ".", "..") can unexpectedly return binaries listed in PATH.

A race condition in the Go database/sql package can overwrite expected results when a query is cancelled during the Scan method call while other queries run in parallel.

The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection leading to an open redirect. This is considered lower-severity as it cannot be exploited from browsers or email clients.

An issue was discovered in py-lmdb 0.97 where for certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. This occurs when accessing a data.mdb file supplied by an attacker.

A NULL pointer dereference vulnerability was found in the Linux kernel's ALSA driver for the TASCAM US-144MKII device. A malicious USB device can have a configuration with interface number 1 but missing interface 0, leading to a system crash.

A vulnerability in cross-origin redirect handling causes Proxy-Authorization and Proxy-Authenticate headers to persist, potentially leaking sensitive authentication data.

A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.

Insufficient granularity of access control in SEV firmware allows a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID meant for SEV-SNP guests, potentially leading to partial loss of confidentiality.