CVE Vulnerability Catalog

In the Linux kernel DRM driver for Intel Xe (xe), a vulnerability was found in the sysfs initialization for SR-IOV PF. On devm_add_action_or_reset() failure, the cleanup action was called on an uninitialized kobject, leading to kernel warnings and potential use-after-free. The fix separates kobject_init() and kobject_add() calls and registers the cleanup action only after full kobject initialization.

In the Linux kernel graphics driver (drm/amd/display), an out-of-bounds access vulnerability was found in the stream_enc_regs[] array. The eng_id index can be negative or equal to 5 (ENGINE_ID_DIGF), while the array has only 5 elements (indices 0-4). Missing bounds check before indexing leads to memory access beyond the array.

In the Linux kernel, an out-of-bounds read vulnerability was found in the fib6_add_rt2node() function. The issue occurs when adding an IPv6 route with RTA_NH_ID, where the fib6_info structure lacks the trailing fib6_nh. Missing check of the iter->nh pointer before accessing iter->fib6_nh leads to a KASAN error and potential security compromise.

In the Linux kernel, procfs lacks proper RCU protection when accessing task->real_parent in do_task_stat() while reading /proc/[pid]/stat, leading to a use-after-free (UAF). The fix replaces task_tgid_nr_ns() with task_ppid_nr_ns().

In the Linux kernel, a buffer overflow vulnerability was found in the persistent_ram_save_old() function of the pstore/ram subsystem. The function can be called multiple times for the same zone, and when the buffer size changes between calls, it leads to an out-of-bounds write (OOB write) and subsequent out-of-bounds read (OOB read).

A vulnerability related to the corruption of the dirty_list in the block group tree in the btrfs filesystem has been fixed in the Linux kernel. The issue occurs when the EXTENT_TREE_V2 flag is set, leading to improper addition of elements to the list and potentially causing transaction errors.

In the Linux kernel on MIPS architecture, a bug was found in LLVM compiler that incorrectly restores the $gp register used as a global register variable. After kernel relocation, $gp points to unrelocated code, causing an early crash during CPU initialization.

In the pm8916_lbc power supply driver in the Linux kernel, there is a use-after-free vulnerability in extcon_set_state_sync(). The order of IRQ and extcon registration is incorrect, leading to use of a freed pointer.

In OP-TEE versions 3.16.0 through 4.10.0, a use-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A SPMC/SP flows, where a thread calling sp_mem_remove() without a lock can free objects while another thread dereferences them.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.

The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.

In jupyter-server versions 1.12.0 through 2.17.0, a vulnerability allows bypassing CORS origin validation when using `allow_origin_pat`. The issue is due to `re.match()` only anchoring at the start, allowing attacker-controlled domains like `trusted.example.com.evil.com` to pass validation for patterns intended for `trusted.example.com`. This affects CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing, arbitrary code execution, and unauthorized access to sensitive API responses.

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object.

GLPI from version 10.0.4 to 10.0.24 allows a technician to store an XSS payload in the asset locked tab. The payload executes when an administrator views the tab.

Vulnerability in GLPI (versions 9.5.0 through 10.0.24 and 11.0.6) allows low-privilege users with planning access to delete any object in the system.