CVE Vulnerability Catalog

The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored XSS. A user with the ability to create custom tags can embed HTML payloads containing JavaScript event handlers in the tag name. When another authenticated user opens a page containing the tag selector, the malicious tag name is inserted into the DOM using jQuery's html property, causing the embedded script to execute.

The AIL Framework contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content. Dynamic values are interpolated directly into the data-content attribute without output encoding, and the popovers are configured with data-html="true", allowing injected markup to execute in the victim's session.

In the Linux kernel, the USB Type-C (ucsi) subsystem's ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them until ucsi_destroy(). Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory.

In the Linux kernel, the iwlwifi (mei) driver's iwl_mei_write_cyclic_buf() function receives an incorrect first argument — the q_head pointer is passed instead of cldev. The bug has been fixed.

In the Linux kernel, the drm/msm driver does not safely retire a hung submit before GPU recovery completes. Retiring the submit triggers BO free, which can result in GPU pagefaults since the GPU may be actively accessing those BOs.

In the Linux kernel, the staging rtl8723bs driver has a memory leak on error paths in issue_beacon(), issue_probersp(), and issue_asocrsp(). When an error occurs after a successful alloc_mgtxmitframe() but before dump_mgntframe(), the management xmit_frame and xmit_buf are neither freed nor placed on any list. Repeated occurrences progressively exhaust the management-TX pools until the interface can no longer send beacons or probe/assoc responses.

In the Linux kernel, in the RDMA/srpt driver, the function srpt_alloc_rw_ctxs() on partial failure does not reset the n_rw_ctx and n_rdma counters and does not clear the rw_ctxs pointer, leading to incorrect send queue credit accounting. The fix resets the counters and clears the pointer before returning an error.

In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.

In the Linux kernel, a bug in the ext4 filesystem related to transaction overflow during writeback was fixed. A previous fix was too eager in reducing reserved transaction credits, leading to insufficient reservation in some corner cases. The fix uses ext4_meta_trans_blocks() for a correct upper bound estimate.

In the Linux kernel, a problem in the ACPI subsystem was fixed where the use of acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device() was unsafe because the returned device could be freed at any time. The fix replaces it with acpi_bus_get_primary_device() and adjusts the code to call it only once.

In the Linux kernel, a memory leak in the HSR (High-availability Seamless Redundancy) module was fixed. When hsr_dev_finalize() fails after registering an RX handler, dynamic nodes learned in that window are not released. The fix frees both dynamic databases in the error unwind path.

In the Linux kernel, a bug in the netfilter nf_nat_sip module was fixed where the offset was not rewound when NAT shrinks the packet. If map_addr() changes the packet length, coff may point to an incorrect position, potentially causing subsequent Contact headers to be skipped and leaking internal network details.

In kitty from version 0.47.3 before 0.49.0, the colour control escape code handler does not neutralize field names in replies, allowing a program writing to the terminal to execute an arbitrary command in the user's shell. An attacker can compose a shell command using printable ASCII characters and a newline from handle_remote_ssh().

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, tag, category, author and date archives, sidebar widgets, or RSS feed.

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0. An authenticated attacker with Wagtail Editor privileges can execute arbitrary code in the victim's browser via a crafted payload.

Seclore FileSecure Desktop Client before 3.25.1.0 contains an improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems.

Netgate pfSense version 26.03.1-RELEASE is vulnerable to Cross Site Scripting (XSS), allowing an attacker to execute arbitrary code in the victim's browser context through the pfBlockerNG package.

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function.

An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the _retry_request function fails to validate the destination host before attaching sensitive authentication headers.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request.