CVE Vulnerability Catalog

NASA cFS up to version 7.0.0 has a vulnerability in the function pickle.load in the Pickle Module component that leads to deserialization. The attack requires local access and is considered difficult to exploit. The project was informed but has not responded.

The ProjectsAndPrograms School Management System up to version 6b6fae5426044f89c08d0dd101c7fa71f9042a59 contains an unrestricted file upload vulnerability in the Profile Picture Handler component in /admin_panel/settings.php. Manipulation of the File argument allows remote uploading of arbitrary files without proper restrictions.

In the mixelpixx Google-Research-MCP project, a server-side request forgery (SSRF) vulnerability was found in the extractContent function of content-extractor.service.ts. The attack can be performed remotely by manipulating the URL argument.

In the Linux kernel, a memory leak has been found in the cache_release function in the sunrpc subsystem. When a reader's file descriptor is closed while reading a cache_request (rp->offset != 0), cache_release() decrements the readers count but never checks whether it should free the request. This can lead to a memory leak if CACHE_PENDING is clear and readers drop to zero.

In the Linux kernel mac80211 subsystem, a crash occurs during channel switch (CSA) for stations on AP_VLAN interfaces (e.g., 4addr WDS clients). ieee80211_chan_bw_change() uses sta->sdata pointing to VLAN without channel reservation, causing a NULL pointer dereference.

In the Linux kernel, in the atmel-sha204a crypto driver, a ->tfm_count leak has been detected. If memory allocation fails, the counter is not decremented, which can block future reads.

In the Linux kernel drm/xe driver, a memory leak occurs in xe_vm_madvise_ioctl. When check_bo_args_are_sane() validation fails, previously allocated resources are not freed, causing a memory leak.

In FastMCP prior to version 3.2.0, a Confused Deputy vulnerability was found in the OAuthProxy component. During GitHub OAuth integration, the server does not properly validate user consent, which combined with GitHub skipping the consent screen enables an attack.

Budibase prior to version 3.23.25 lacks rate limiting or CAPTCHA on the password reset endpoint. An unauthenticated attacker can repeatedly trigger password reset requests for the same email, flooding the inbox with hundreds of emails.

In the Linux kernel, in the SPI subsystem, per-CPU statistics are allocated only after the controller is registered with the driver core, leaving a window where accessing sysfs attributes can trigger a NULL-pointer dereference. The fix moves statistics allocation to controller allocation time.

In the Linux kernel, a bug in the RedBoot partition table parser causes a buffer overflow warning and oops when CONFIG_FORTIFY_SOURCE is enabled with a recent compiler. The issue is due to using memcmp() instead of strcmp() for string comparison.

In the Linux kernel, a vulnerability in the serial core driver causes an infinite loop in handle_tx() for PORT_UNKNOWN ports. The uart_write_room() function returns a value greater than zero while uart_write() returns 0 when the transmit buffer (xmit_buf) is uninitialized, leading to a system hang.

In the Imagination DRM driver in the Linux kernel, a deadlock occurs during soft reset because disable_irq() is called from the IRQ handler context, causing a self-wait.

In the Linux kernel, the DRM driver for Imagination GPUs lacks interrupt synchronization before GPU suspend. The runtime PM suspend callback does not check if the IRQ handler is running on another CPU core and does not wait for it to finish. This can cause kernel crashes when trying to access GPU registers after suspension.

In the Linux kernel, in the drm/amdgpu driver, a limit of 128k entries per BO list has been introduced to prevent resource exhaustion. Userspace could pass an arbitrary number of entries, leading to excessive memory allocation and long processing times.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the i915/DMC driver during initialization. The issue occurs when intel_dmc_update_dc6_allowed_count() is called before DMC initialization, potentially causing a system crash (oops).

In the Linux kernel, in the btrfs filesystem, a bug has been found in logging new dentries when logging the parent directory of a conflicting inode. If the parent directory is later fsynced without new changes, new dentries may be lost after a power failure.

In the Linux kernel, in the soc: microchip: mpfs driver, a memory leak has been detected in the mpfs_sys_controller_probe() function. If of_get_mtd_device_by_node() fails, the function returns without freeing the allocated memory for sys_controller, leading to a memory leak.

In the qbman driver for Freescale SoCs in the Linux kernel, a race condition in qman_destroy_fq can trigger a false WARN_ON when creating a queue with QMAN_FQ_FLAG_DYNAMIC_FQID set.

In the Linux kernel, in the ROSE protocol, there is a NULL pointer dereference in rose_transmit_link on reconnect. When rose_connect() is called a second time while the first connection is in progress (TCP_SYN_SENT), it overwrites rose->neighbour, and if rose_get_neigh() returns NULL, the socket is left with rose->neighbour == NULL. Closing the socket leads to a NULL pointer dereference. A check for TCP_SYN_SENT is missing.