CVE Vulnerability Catalog

In the Linux kernel VIA watchdog driver (via_wdt), a vulnerability causes a critical system hang during boot. The issue arises because the allocated MMIO resource lacks a name, resulting in a "<BAD>" entry in the kernel resource tree.

In the Linux kernel's af_alg crypto mechanism, a vulnerability was found due to missing zero-initialization of memory allocated via sock_kmalloc(). Uninitialized context and request structures can lead to use of garbage values; specifically, the newly added 'inflight' field causes random -EBUSY errors in multi-threaded AIO requests.

A vulnerability in the Linux kernel's KVM for x86 causes a hard lockup of the virtual machine after prolonged inactivity with a periodic HV timer. The issue arises from incorrect calculation of the APIC timer expiration in periodic mode, leading to excessive timer interrupts and potential host lockup.

A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.

Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation requires user interaction – the victim must open a malicious file.

Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation requires user interaction – the victim must open a malicious file.

Substance3D - Designer versions 15.0.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

The vulnerability involves expiring Microsoft certificates in Secure Boot. Failure to update them may cause loss of Secure Boot functionality and protection against malware. The update process can be disrupted by firmware defects.

Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally.

An exposure of sensitive information vulnerability in Windows File Explorer allows an authorized attacker to disclose information locally.

An exposure of sensitive information vulnerability in Windows File Explorer allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information via a physical attack.

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.

An exposure of sensitive information in Windows File Explorer allows an authorized attacker to disclose information locally.

A race condition in Windows SMB Server allows an authenticated attacker to cause a denial of service over the network.

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.