CVE Vulnerability Catalog

In the Linux kernel, the ath5k driver has an out-of-bounds array access. The index 'ts->ts_final_idx' can be 3 on 5212 hardware, causing a write beyond the 'rates' array of size 4. The issue was reported by UBSAN. The patch adds a check to ensure the index is less than the array size before setting the sentinel.

A vulnerability was found in the Linux kernel's flow_dissector, which mishandles PPPoE frames with Protocol Field Compression (PFC). Sending a crafted PPPoE PFC frame to a network interface on MIPS architecture can cause an unaligned access exception, leading to a system crash.

In the Linux kernel, a vulnerability was found in the NVMe over Fabrics (NVMe-oF) target subsystem where nvmet_ctrl_free() calls flush_work on the same nvmet-wq workqueue, potentially causing a deadlock and triggering a lockdep recursive locking warning.

A vulnerability was found in the Linux kernel's ISO 9660 filesystem (isofs) related to Rock Ridge extension validation. The rock_continue() function reads the extent block number from the CE record without checking if it is within the mounted volume bounds, potentially leading to out-of-range reads or reads from adjacent filesystems. Although no memory safety violation occurs, it may enable information leakage via readlink().

In the Linux kernel topcliff-pch SPI driver, a use-after-free vulnerability occurs during driver unbind. The SPI queue is not flushed before releasing DMA buffers, which can lead to use of already freed memory.

In the Linux kernel HFS+ filesystem, a held lock is freed without release on an error path in hfsplus_fill_super(). The function fails to release tree->tree_lock before jumping to the out_put_root label after a failed hfsplus_cat_build_key() call, triggering a held lock freed warning.

In the Linux kernel, a buffer overflow was found in the retrieve_status function in the dm-ioctl driver. The bug is due to missing overflow check when aligning the outptr pointer to an 8-byte boundary, potentially leading to out-of-bounds write. However, the vulnerability has no security implications because only root can issue device mapper ioctls and libraries use 8-byte aligned buffers.

In the Microchip MPFS-CCC clock driver in the Linux kernel, there is an out-of-bounds access during PLL output registration. The hws array is too small, leading to read/write beyond allocated memory.

In the Linux kernel, a use-after-free (UAF) bug was found in the of_unittest_changeset() function in unit tests. The variable 'parent' points to the same device as 'nchangeset', and calling of_node_put(nchangeset) can free memory that is later accessed by 'parent'. The bug only affects test code but may mask more serious issues.

In the MTD docg3 driver in the Linux kernel, there is a use-after-free vulnerability in docg3_release(). The docg3 pointer is used after memory is freed, leading to a dangling pointer dereference.

In the Linux kernel, a buffer overflow was found in the vrealloc_node_align() function in the vmalloc allocator. When shrinking an allocation (size < old_size), the code copies old_size bytes into the new buffer, causing an out-of-bounds write. The bug was introduced in commit 4c5d3365882d.

In the Linux kernel HMM test (test_hmm), there is a use-after-free vulnerability. When closing the file, device pages are not migrated back to system memory, leaving a dangling zone_device_data pointer.

In the Linux kernel, a vulnerability was found where allocation tags (codetags) are not initialized for pages allocated before the page_ext structure is set up. This causes warnings and potential errors when such pages are freed, especially in configurations with memory allocation profiling debugging enabled.

In the Linux kernel mm/zone_device, after calling ->folio_free() on a device folio, its contents can immediately change (the folio may be reallocated by a driver with a different order). The code touched the folio again after freeing to extract the pgmap, which is unsafe. The fix uses a local stack variable to store the pgmap before calling ->folio_free().

STACKIT IaaS API contains a missing authorization check in the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach an arbitrary service account to a virtual machine they control without validation of their permission to use it, then query the Instance Metadata Service (IMDS) to retrieve an OAuth2 token for that service account and act with its privileges. The impact is confined to the attacker’s own project. The STACKIT Identity Provider enforces strict project matching between the target VM and the requested service account during token impersonation, so cross-project and cross-organization exploitation is not possible. Any further access is bounded by the IAM roles already assigned to the targeted service account.

Vulnerability in OpenBullet2 up to version 0.3.2: authenticated remote code execution via creating or modifying job configurations. The plain C# execution mode lacks reference filtering, allowing access to the file system, process spawning, and arbitrary .NET API calls.

A vulnerability in OpenBullet2 through version 0.3.2 allows authenticated users to execute arbitrary commands by uploading script files (.bat, .ps1, .sh) through the FileProxySource proxy loading feature. Attackers can upload malicious script files as proxy sources, causing the server to execute the scripts and return output as proxy lines, resulting in arbitrary command execution on the host as the process user.

OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint, allowing authenticated attackers to read, write, and delete arbitrary files by supplying unsanitized absolute paths. Attackers can chain these operations to achieve remote code execution by manipulating critical system files such as /etc/passwd, as the application runs as root by default.

SQL injection vulnerability in imvks786 student_management_system (up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46) in admin/admin_login.php via a_usr/a_pwd arguments. Remote attack possible, exploit public.

SQL injection vulnerability in imvks786 student_management_system (up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46) in /index.ph via usr/pwd arguments. Remote attack, exploit public.