CVE Vulnerability Catalog

The Onion module in AIL Framework has a performance shortcut in URL extraction that accepts URLs as valid .onion targets based only on a length check (exactly 69 characters) and a suffix check (ending in '.onion'), without proper hostname parsing. An unauthenticated attacker who can publish or control web content crawled by the framework can embed a crafted URL with an IP address or non-onion hostname that satisfies these conditions and gets queued as a legitimate onion crawler task.

The AIL Framework crawler task creation API (api_add_crawler_task) has an insufficient authorization check when a user supplies a cookiejar UUID. The original code only verified that the cookiejar exists and, if its access level was 0, compared the owner user ID to the requesting user ID. It did not validate organizational boundaries or account for the user's role. An authenticated user can reference another organization's cookiejar and have the crawler use that organization's stored cookies when performing web crawls.

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions and rendered into the DOM using D3's html() method in the tooltip, allowing arbitrary JavaScript execution in the analyst's browser when hovering over a timeline entry.

The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored XSS. A user with the ability to create custom tags can embed HTML payloads containing JavaScript event handlers in the tag name. When another authenticated user opens a page containing the tag selector, the malicious tag name is inserted into the DOM using jQuery's html property, causing the embedded script to execute.

The AIL Framework contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content. Dynamic values are interpolated directly into the data-content attribute without output encoding, and the popovers are configured with data-html="true", allowing injected markup to execute in the victim's session.

In the Linux kernel, the USB Type-C (ucsi) subsystem's ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them until ucsi_destroy(). Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory.

In the Linux kernel, the iwlwifi (mei) driver's iwl_mei_write_cyclic_buf() function receives an incorrect first argument — the q_head pointer is passed instead of cldev. The bug has been fixed.

In the Linux kernel, the drm/msm driver does not safely retire a hung submit before GPU recovery completes. Retiring the submit triggers BO free, which can result in GPU pagefaults since the GPU may be actively accessing those BOs.

In the Linux kernel, the staging rtl8723bs driver has a memory leak on error paths in issue_beacon(), issue_probersp(), and issue_asocrsp(). When an error occurs after a successful alloc_mgtxmitframe() but before dump_mgntframe(), the management xmit_frame and xmit_buf are neither freed nor placed on any list. Repeated occurrences progressively exhaust the management-TX pools until the interface can no longer send beacons or probe/assoc responses.

In the Linux kernel, in the RDMA/srpt driver, the function srpt_alloc_rw_ctxs() on partial failure does not reset the n_rw_ctx and n_rdma counters and does not clear the rw_ctxs pointer, leading to incorrect send queue credit accounting. The fix resets the counters and clears the pointer before returning an error.

In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.

In the Linux kernel, a bug in the ext4 filesystem related to transaction overflow during writeback was fixed. A previous fix was too eager in reducing reserved transaction credits, leading to insufficient reservation in some corner cases. The fix uses ext4_meta_trans_blocks() for a correct upper bound estimate.

In the Linux kernel, a problem in the ACPI subsystem was fixed where the use of acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device() was unsafe because the returned device could be freed at any time. The fix replaces it with acpi_bus_get_primary_device() and adjusts the code to call it only once.

In the Linux kernel, a memory leak in the HSR (High-availability Seamless Redundancy) module was fixed. When hsr_dev_finalize() fails after registering an RX handler, dynamic nodes learned in that window are not released. The fix frees both dynamic databases in the error unwind path.

In the Linux kernel, a bug in the netfilter nf_nat_sip module was fixed where the offset was not rewound when NAT shrinks the packet. If map_addr() changes the packet length, coff may point to an incorrect position, potentially causing subsequent Contact headers to be skipped and leaking internal network details.

In kitty from version 0.47.3 before 0.49.0, the colour control escape code handler does not neutralize field names in replies, allowing a program writing to the terminal to execute an arbitrary command in the user's shell. An attacker can compose a shell command using printable ASCII characters and a newline from handle_remote_ssh().

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, tag, category, author and date archives, sidebar widgets, or RSS feed.

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0. An authenticated attacker with Wagtail Editor privileges can execute arbitrary code in the victim's browser via a crafted payload.

Seclore FileSecure Desktop Client before 3.25.1.0 contains an improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems.

Netgate pfSense version 26.03.1-RELEASE is vulnerable to Cross Site Scripting (XSS), allowing an attacker to execute arbitrary code in the victim's browser context through the pfBlockerNG package.