CVE Vulnerability Catalog

W systemie zarządzania plikami Campcodes School File Management System w wersji 1.0 zidentyfikowano słabość, która wpływa na nieznaną funkcję pliku /update_query.php. Manipulacja argumentem stud_id prowadzi do wstrzykiwania SQL.

In the Linux kernel, NFSD lacks handling for the new time_deleg FATTR4 attributes in GETATTR requests. The server may crash if a client sends an invalid GETATTR for these attributes. According to RFC specification, such usage is invalid, and NFSD will return nfserr_inval.

W jądrze Linuxa naprawiono podatność, która powodowała awarię w funkcji nfsd4_read_release() podczas włączonego śledzenia. Problem występował podczas testu pynfs read.testNoFh.

A use-after-free vulnerability was discovered in the Linux kernel's fbcon driver. During framebuffer unregistration, the mode list memory is freed but the pointer in fb_display[] is not set to NULL, leading to access of freed memory during subsequent operations on other framebuffers.

In the fbdev (bitblit) subsystem of the Linux kernel, a missing bounds check for the font glyph index was found. This could lead to an out-of-bounds read of the built-in font array.

In the Linux kernel, a race condition in the BPF ring buffer could queue irq_work before buffer freeing, causing use-after-free. The fix synchronizes irq_work before freeing the buffer.

In the Linux kernel's Bluetooth stack (hci_sync), a race condition in hci_cmd_sync_dequeue_once allowed double list deletion and use-after-free (UAF). The fix holds the lock across both lookup and cancel operations.

A bug in the Linux kernel's regmap initialization for the SLIMbus bus uses an incorrect bus_context pointer. The issue was exposed after a change in the WCD934x codec driver, causing a memory page fault during audio playback on the Dragonboard 845c board.

A use-after-free vulnerability was discovered in the Linux kernel's Bluetooth SCO driver. The sco_conn_free function can be called on already freed memory, leading to a security breach.

In the Linux kernel's exfat filesystem, cluster allocation bits in the bitmap were not validated. An attacker could craft an exfat image with an invalid bitmap, causing overwrite of existing entries during directory creation. The fix adds validation that bitmap clusters are marked as in-use.

In the Linux kernel's OrangeFS (orangefs) filesystem driver, a buffer overflow vulnerability was found in extended attribute (xattr) handling. The helper function `xattr_key()` incorrectly checks the loop condition, causing an infinite loop and potential system hang. Additionally, incorrect use of the `hash_add` macro led to memory leaks and unfreed allocations.

In the fbdev (bit_putcs) subsystem of the Linux kernel, missing bounds checking when rendering text near screen edges was found. This could lead to out-of-bounds writes to the framebuffer.

In the Linux kernel, a vulnerability in Btrfs allows dirty metadata to be written back after an error, causing use-after-free with RAID56 metadata. The issue occurs because metadata writes are not discarded when the filesystem is in an error state, leading to queued work on already stopped workqueues.

In the Linux kernel, the videobuf2 driver lacks protection against calling the remove_bufs ioctl while legacy fileio mode is active. This could overwrite pointers used by fileio and corrupt the internal queue state.

In the Linux kernel's Bluetooth stack (hci_event), the skb length was not checked before reading data for an unknown opcode in command complete events, potentially using uninitialized memory. The fix adds a length check.

In the Linux kernel's network bridging subsystem (net/bridge), a use-after-free was found when deleting an expired FDB entry. The issue is due to a race condition between FDB learning and port deletion when MST is enabled and VLAN filtering is disabled. MST bypasses the port state, allowing FDB learning at an inappropriate time.

In the virtio-net driver of the Linux kernel, an incorrect length check for received big packets was found. This could lead to a NULL pointer dereference and system crash.

In the Linux kernel's io_uring subsystem, the number of segments calculated by io_estimate_bvec_size was truncated, causing data corruption. The fix checks that the value does not overflow int range.

In the Linux kernel, a vulnerability in the XSK (AF_XDP) mechanism stores the descriptor number in the skb control block, causing data corruption. After transmission, other subsystems can overwrite this block, leading to a NULL pointer dereference and kernel panic.

Zidentyfikowano podatność w systemie zarządzania hotelem tushar-2223, która dotyczy nieznanej funkcji w pliku /admin/invoiceprint.php. Manipulacja argumentem ID prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.