CVE Vulnerability Catalog

In the Elan I2C touchpad driver, missing validation of x_traces and y_traces can lead to division by zero and kernel panic. Additionally, an arithmetic underflow in touch reporting logic when width is less than 90 causes a huge unsigned integer to be reported to userspace.

In the FUSE filesystem in the Linux kernel, there is a vulnerability due to 32-bit multiplication wrap in the prune notification payload length validation. The daemon-controlled multiplication count * sizeof(u64) can wrap, bypassing the check and leading to out-of-bounds read.

In the Linux kernel fuse-uring subsystem, a vulnerability exists where the EFAULT error is overwritten. After a copy_from_user() failure, fuse_uring_commit() sets err to a positive residual, causing fuse_uring_req_end() to overwrite -EFAULT with a positive value, masking the error.

In the Linux kernel fuse-uring subsystem, a vulnerability leads to a NULL pointer dereference. The fuse_uring_cancel() function moves cancelled entries to the ent_in_userspace list, and ent_list_request_expired() dereferences ent->fuse_req without checking, causing a crash.

In the Linux kernel FUSE-uring subsystem, a bug causes incomplete cleanup of FUSE requests when io_uring cancels task work (e.g., thread exit). The requesting thread hangs in D-state and the background counter inflates, eventually stalling all subsequent FUSE operations.

In the Linux kernel fuse-uring subsystem, a vulnerability leads to a NULL pointer dereference. If a copy into the userspace ring buffer fails, the entry remains on ent_w_req_queue with ent->fuse_req set to NULL, potentially causing a crash when the list is scanned.

In the Linux kernel, the XFS filesystem has a vulnerability where quota IDs wrap around during iteration. When the ID reaches the maximum value (XFS_DQ_ID_MAX), addition truncates it to zero, restarting the iteration and potentially causing incorrect quota enforcement.

The Yoast SEO plugin for WordPress up to version 28.0 is vulnerable to stored XSS via the Post Slug (post_name) field. Authenticated attackers with author-level access or higher can inject malicious scripts that execute when a user visits the affected page. Pretty permalinks must be enabled.

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress up to version 3.7.7 is vulnerable to Directory Traversal via the 'thwcfe_legacy_file' parameter. Authenticated attackers with subscriber-level access or higher can read arbitrary files on the server.

In libsoup, after establishing a CONNECT tunnel through an HTTP proxy, the Proxy-Authorization header is incorrectly attached to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials.

In libsoup, the chunked transfer encoding parser uses a permissive parsing function that accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

In libsoup, an unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can send a crafted response, causing the client application to crash or disclose sensitive heap memory.

The Weintek cMT3092X HMI terminal stores user account passwords in plaintext.

An attacker can modify data that should be restricted to read-only access.

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.

FFmpeg through 8.1.2 contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, copying uninitialized heap contents into the attacker-observable AVFrame output, potentially defeating ASLR in long-lived media processing services.

FFmpeg through 8.1.2 contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs handler stores raw innerHTML of pasted span elements with data-type="emoji" without sanitization, and the toMarkdown runner subsequently assigns this unsanitized value directly to a live DOM element's innerHTML, bypassing the DOMPurify sanitization used in the toDOM path, causing payload execution on every markdown serialization cycle.

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a rendered link. The parseMarkdown runner stores raw URL values from the remark AST as href mark attributes without URL scheme validation, and the ineffective DOMPurify.sanitize call in edit-view.ts treats the bare URL string as a text node and returns it unchanged, allowing javascript: payloads to pass through the link-tooltip preview component and read-only mode anchor elements unmodified.

Hulumi prior to version 1.4.0 contains a vulnerability where AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.