CVE Vulnerability Catalog

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability in the adjustAccount endpoint, allowing admin-level users to extract arbitrary database contents via unsanitized POST parameters.

In the Linux kernel NTB EPF driver, during teardown when BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, pci_iounmap() was called with an offset on the same iomem, which is unnecessary and triggers a kernel warning. The fix unmaps only when the BARs are different.

In the Linux kernel copy_process() function, the PF_BLOCK_TS flag was not cleared during process copying. This flag is only set when current->plug is non-NULL, and copy_process() inherits it from the parent but resets the child's plug to NULL, breaking the invariant. The fix clears PF_BLOCK_TS alongside the plug reset.

In the Linux kernel for MIPS DEC, a vulnerability occurs when the initial console output handler's buffer is placed in the XKPHYS 64-bit memory segment. The 32-bit firmware truncates the address, causing memory access errors and kernel crashes.

In the Linux kernel for LoongArch architecture, a vulnerability was found where the stop_this_cpu() function fails to inform RCU about CPU shutdown. This causes RCU to expect quiescent states from CPUs that are already offline and spinning with interrupts disabled, potentially hanging the system during reboot or shutdown.

In the Linux kernel, a vulnerability was found in MIPS where stop_this_cpu() marks CPUs offline for the scheduler but does not inform RCU. This blocks reboots because RCU waits for quiescent states from parked CPUs that are spinning with interrupts disabled.

In the Linux kernel, a vulnerability was found in the memory driver (drivers/base/memory) where mem->altmap is set before successful device registration. If xa_store() fails, device_unregister() triggers memory_block_release() with altmap set, causing a WARN_ON.

In the Linux kernel, multiple issues were found in the GPIO rockchip driver: a debounce clock reference leak, failure to disconnect the chained IRQ handler, and an IRQ domain leak. These bugs could lead to kernel panics and resource leaks.

In the Linux kernel, a vulnerability was found in the media rc igorplugusb driver where the control request setup packet was incorrectly passed to usb_fill_control_urb(). The driver passed a pointer to the ir->request field instead of the allocated usb_ctrlrequest structure, leading to incorrect control direction.

In the Linux kernel, a deadlock was found in the gpio:shared driver during parent proxy removal. The issue was caused by an overly wide critical section of the mutex protecting the offset field.

In the i2c:davinci driver in the Linux kernel, a missing 'clock-frequency' device tree property caused a division by zero. The default value was defined in kHz instead of Hz, leading to a kernel panic.

In the pch_uart serial driver in the Linux kernel, the return value of dma_alloc_coherent() was not checked. A failed allocation could lead to a NULL pointer dereference.

In the Linux kernel USB gadget UVC driver, a vulnerability was found due to missing lock synchronization when walking the extension units list during function binding. The uvc_function_bind() function traverses the list without holding opts->lock, which can race with configfs operations and lead to use-after-free.

In the Linux kernel, the DRM MSM DSI driver has a vulnerability where memory dumping can access past the mapped region due to an unadjusted size. This can lead to accessing unmapped memory.

In the tps65219 voltage regulator driver in the Linux kernel, the irq_data.rdev field is not assigned, causing undefined behavior when the IRQ handler calls regulator_notifier_call_chain(). This can lead to an Oops error.

In the Linux kernel, a vulnerability was found in the TLB invalidation mechanism on x86 architecture. When booting with 'nopcid' (disabling PCID), broadcast TLB invalidation (INVLPGB) can still be used with a non-zero PCID, causing a general protection fault (#GP) and system crash.

In the Linux kernel, the ethtool PHY helper has a NULL pointer dereference vulnerability when the PHY driver is unbound via sysfs. The phy_remove() function clears the drv pointer but does not detach the device, causing a crash when reading the driver name.

In the Linux kernel, several ACPI platform drivers lack a NULL check for the ACPI companion object. Since any platform driver can be forced to match a non-ACPI device, this can lead to errors.

In the Linux kernel's device property subsystem, a vulnerability was found due to an uninitialized secondary pointer in the fwnode structure. If a node is initialized via fwnode_init() without zeroing memory, the pointer may contain garbage, leading to dereference.

In the Linux kernel's MSM graphics driver (drm/msm/a6xx), a NULL pointer dereference vulnerability was found in a8xx_hfi_send_perf_table. The function does not check the return value of kzalloc(), potentially leading to a crash on memory allocation failure.