CVE Vulnerability Catalog

In the Linux kernel, the airoha network driver was missing DMA TX descriptor reset in airoha_qdma_cleanup_tx_queue(). The fix adds the missing operations, similar to airoha_qdma_cleanup_rx_queue(), and resets TX_DMA_IDX to TX_CPU_IDX to notify the NIC that the QDMA TX ring is empty.

In the Linux kernel irqchip/imgpdc driver, a resource leak and missing chained handler cleanup on driver removal were found. Generic chips allocated during probe are not freed and chained handlers are not removed, potentially causing use-after-free and kernel crash.

In the Linux kernel fbdev subsystem, fb_new_modelist() fails to ensure the current display mode (info->var) remains in the modelist after a user-space mode list change. This causes a null-ptr-deref in fb_videomode_to_var() during a later console takeover.

In the Linux kernel's NFS server (nfsd), the write verifier is not rotated after detecting a deferred writeback error. This causes the NFS client to receive an unchanged verifier and incorrectly assume data is durable, leading to silent data loss.

A null-ptr-deref bug was found in the Linux kernel's vcs_notifier() due to a race condition in vcs_write(). When the console lock is temporarily dropped, the vc_data pointer may become stale; after re-acquiring the lock and detecting NULL, calling vcs_scr_updated() causes a null pointer dereference.

In the Linux kernel, a vulnerability in the vidtv driver causes a NULL pointer dereference in vidtv_mux_push_si due to missing NULL check on vidtv_mux_get_pid_ctx() return value, leading to a general protection fault. The root cause is insufficient error handling in vidtv_mux_pid_ctx_init() for PMT section PIDs.

In the Linux kernel, the OV8856 camera driver has a vulnerability where the control handler is not freed if adding controls fails in the ov8856_init_controls() function.

A vulnerability in the Linux kernel's DRM driver was found due to improper blob property reference tracking in the colorop state lifecycle. This caused memory leaks during state duplication, destruction, and reset operations because blob references were not released before freeing memory.

In the Linux kernel DRM driver for MSM (Qualcomm Adreno), a bug was fixed where the GPU recovery mechanism would not trigger if there were no pending jobs. This left the GPU in a hung state, leading to repeated timeouts.

In the Linux kernel, the drm/amdkfd driver lacked an upper bound check for num_of_nodes in kfd_ioctl_get_process_apertures_new. This could lead to an out-of-bounds memory read.

In Courier Management System up to version 1.0, a flaw exists in /index.php. Manipulation of the page parameter leads to cross-site scripting (XSS). The attack can be launched remotely, and an exploit has been published.

In the Linux kernel, a vulnerability in the iommu/vt-d driver causes loss of dirty tracking when attaching PASID to a nested domain. The kernel lacks dirty tracking support for such configurations, potentially losing information about modified memory pages.

In the Linux kernel, the RDMA/ionic driver has a vulnerability where hca_type_show() uses unbounded "%s" to display node_desc, which may not be NUL-terminated, causing an out-of-bounds read into adjacent fields of struct ib_device.

In the Linux kernel, the perf/x86/intel subsystem had incomplete validation and configuration of ACR (Adaptive Cache Replacement) masks. Issues included missing checks for indices belonging to other event groups, premature iteration exit on invalid masks, and failure to clear stale hardware masks before setting new ones.

In the Linux kernel, the SELinux module had a bug in the avdcache auditing mechanism. It incorrectly saved and reused the audit vector instead of recomputing it based on current permissions, causing some access checks (e.g., directory write after a cached search check) to be missed.

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0, where the save_settings function in /admin/admin_class_novo.php fails to properly validate the img argument, allowing unrestricted file upload. The attack can be performed remotely.

A security flaw in snap7 up to version 1.4.3 involves an out-of-bounds write in the TSnap7Peer::NegotiatePDULength function. The attack can be executed remotely by manipulating the PDULength argument.

A vulnerability was found in MoviePilot up to version 2.13.5 in an unknown function of the file /jxxghp/MoviePilot within the Application API component. The issue involves improper authorization, allowing remote exploitation.

SSRF vulnerability in 1Panel-dev CordysCRM up to version 1.4.1 in the getSqlBotSrc function of IntegrationConfigService.java. A remote attacker can manipulate the appSecret argument, leading to HTTP requests to arbitrary internal resources.

A server-side request forgery (SSRF) vulnerability was found in the Third Party Endpoint component of CordysCRM up to version 1.4.1. The issue occurs in the TokenService.java file, where manipulation of the mkAddress argument allows remote attack execution. The project closed the report, stating it is not the official way to report a security vulnerability.