CVE Vulnerability Catalog

In the Linux kernel, the mmc via-sdmmc driver does not cancel carddet_work on device removal; already queued work can run after the host is freed, causing a use-after-free. The fix cancels carddet_work after freeing the IRQ and before cancelling finish_bh_work.

In the Linux kernel, the mmc via-sdmmc driver registers and enables the card-detect interrupt before mmc_add_host(); if mmc_add_host() fails, the interrupt stays registered and runs against the freed host, causing a use-after-free. The fix adds a probe-error path that disables and frees the interrupt and cancels carddet_work.

In the Linux kernel, ISST lacked a NULL check for isst_common.sst_inst[] on failed socket loading, potentially leading to a NULL dereference. The fix adds a NULL check for consistency with other places.

In the Linux kernel, the platform/x86 ISST driver lacked validation of the logical CPU ID and CLOS ID used by the core power feature. Values exceeding the supported maximum were not rejected even though they are used to calculate the MMIO offset.

In the Linux kernel, the platform/x86 int1092 driver did not free the memory allocated for device_mode_info in parse_package() on some error paths in sar_probe(). This caused a memory leak.

In the Linux kernel, the panasonic-laptop driver has an out-of-bounds write past the pcc->sinf[] array. The function acpi_pcc_retrieve_biosdata() writes a sentinel value at index equal to the SINF package count, which when num_sifr equals that count results in a one-element overflow (a silent 4-byte heap overflow). This occurs on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements.

The Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 allows inclusion of functionality from an untrusted control sphere. Crafted repository content can modify the workspace settings file, redirecting the Kiro Powers registry request to an attacker-controlled endpoint and sending workspace data when the Powers panel is opened.

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. A user permitted to add entries to one Express object could create entries in a different Express object outside their authorization scope.

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type is updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), allowing a signed-in dashboard user to modify Page Types outside their assigned authorization boundary.

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a link on the site's own domain that sends a user to an arbitrary external site after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow.

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Relocating a group under a new parent causes its members to inherit the parent's permissions.

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request only against the target board instance and then persists the client-supplied selectedTemplateOption[collection] verbatim, allowing a user with permission to edit board contents to store a forged summary object with a JavaScript-bearing HTML payload in the description field. The default summary template renders the description field without output encoding.

In the Linux kernel, the platform/x86 think-lmi driver's multi-certificate support allows the system authentication object to store ->signature and ->save_signature, which leak when the driver is removed. This causes a memory leak.

In the Linux kernel, the platform/chrome sensorhub driver did not validate the EC-reported sensor number (in->sensor_num) in cros_ec_sensorhub_ring_handler(). A value equal to or greater than sensor_num caused an out-of-bounds read and write of the batch_state[] array.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_stb_s2d_init() discarded the return values of several S2D SMU commands and the S2D_PHYS_ADDR_LOW/HIGH values. On failure the physical address was left uninitialized and passed to devm_ioremap(), potentially mapping physical address 0.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_pmc_probe() registered the LPS0 s2idle handler and created the debugfs directory before calling amd_stb_s2d_init(). When the latter failed, the error path did not unregister the handler or remove the debugfs directory, leading to list corruption and a kernel BUG on module reload.

In the Linux kernel, the platform/x86 hp-bioscfg driver's sk_store() and kek_store() stripped a trailing newline before allocating the key buffer, but passed the original count instead of length to hp_wmi_perform_query(). This caused a one-byte read past the allocated buffer.

In the Linux kernel, the platform/x86 hp-bioscfg driver's validate_password_input() computed length = strlen(buf) and checked buf[length - 1] without first ensuring length is nonzero. Writing an empty string (a bare '\n') to current_password or new_password caused a read of buf[-1], one byte before the heap allocation.

In the Linux kernel, the platform/x86 hp-bioscfg driver's hp_get_string_from_buffer() clamped the converted string length against the destination buffer size using "size > dst_size". When the length equaled dst_size, the unconditional NUL terminator write landed one byte past the destination buffer.

In the Linux kernel's platform/x86 hp-bioscfg module, the per-type ACPI package parsers were handed the wrong element count — instead of the validated obj->package.count they derived it from the NAME field (an ACPI_TYPE_STRING), effectively reading string.length through the acpi_object union. This is safe today because hp_init_bios_package_attribute() rejects packages with fewer elements than the type requires, but an upcoming relaxation of that check would cause an out-of-bounds heap read. The fix forwards the validated obj->package.count to every parser.