CVE Vulnerability Catalog

Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it.

A vulnerability in the libcurl library causes a memory leak when handling HTTP/2 server push. When an application allows server push and the number of headers exceeds the limit of 1000, libcurl aborts the push but fails to free previously allocated headers.

In the Linux kernel, a vulnerability was found in the mechanism preventing timer interrupt starvation. Missing resets of the next_event_forced flag in several places, such as when the clock event state changes, may cause incorrect behavior.

A vulnerability in libfuse versions 3.18.0 through 3.18.1 causes a NULL pointer dereference and memory leak in the fuse_uring_init_queue function. A local user can exploit this to crash the FUSE daemon or exhaust system resources.

In the Linux kernel, a vulnerability in the mshv_vtl component occurs when registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, where the computed vmemmap_shift may exceed MAX_FOLIO_ORDER, leading to incorrect behavior.

A use-after-free vulnerability in SEV firmware allows a malicious hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than the migration agent, potentially leading to loss of integrity.

In the Linux kernel, a vulnerability was found in the F2FS filesystem involving uninitialized value access in the f2fs_sanity_check_node_footer function. The issue was reported by syzbot and may lead to unpredictable system behavior.

A vulnerability in SEV (Secure Encrypted Virtualization) firmware causes insufficient or incomplete data removal in a hardware component, resulting in incomplete IOMMU flushing. This can potentially lead to a loss of confidentiality and integrity in guest memory.

A vulnerability in CPython (from version 0 to 3.6.13, 3.7.0-3.7.10, 3.8.0-3.8.8, 3.9.0-3.9.2) allows Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs functions. An attacker can use a technique called 'parameter cloaking' to manipulate query parameters.

An improper access control vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware allows a malicious hypervisor to bypass RMP protections, potentially compromising SEV-SNP guest memory integrity.

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories.

A vulnerability in the tail utility of uutils coreutils allows exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting its contents.

The sort utility in uutils coreutils crashes (panics) when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and uses expect(), causing an immediate crash upon encountering valid but non-UTF-8 paths.

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original setuid/setgid bits.

An improper access control vulnerability in AMD SEV-SNP allows an admin privileged attacker to write to the RMP during SNP initialization, potentially leading to loss of SEV-SNP guest memory integrity.

In the Linux kernel, in the RDMA/hns driver, a soft lockup issue under heavy CEQE load was fixed by moving CEQE handling to the BH (bottom half) context.

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. It falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID instead of the source's metadata.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access can exploit this race condition.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

The mongo-go-driver contains a heap out-of-bounds read vulnerability in the CGo implementation for GSSAPI (Kerberos) authentication on Linux and macOS. The issue arises from incorrect assumptions about string termination in the GSSAPI standard, potentially leading to data disclosure.