CVE Vulnerability Catalog

In the Linux kernel, virtio_vsock_remove() stops the virtqueues and flushes each work item before freeing the enclosing virtio_vsock, but the order does not account for dependencies: tx_work may queue send_pkt_work, and send_pkt_work may queue rx_work. In particular, send_pkt_work can set restart_rx and release tx_lock, and the remove path can flush rx_work before send_pkt_work queues it, leading to a use-after-free race with kfree(vsock).

In the Linux kernel, w1_f19_i2c_master_transfer(), the master_xfer for the DS28E17 1-Wire to I2C bridge, takes the length from the device on an I2C_M_RECV_LEN read. The driver reads that many bytes into buf[1], but the caller buffer is I2C_SMBUS_BLOCK_MAX + 2 (34 bytes), so a length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core check runs after master_xfer returns, by which time the write is already done.

In the Linux kernel, i2c_nuvoton_wait_for_stat() in the tpm_i2c_nuvoton driver enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out or is interrupted before the handler runs, the function returns without balancing the enable_irq() call.

In the Linux kernel, the "cad_pid" sysctl entry is global and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace, which is wrong.

In the Linux kernel, smack_file_send_sigiotask() was accessing both tsk->cred and __task_cred(tsk). Accessing ->cred on a non-current task is forbidden because a task can change its own ->cred pointer without synchronization, leading to a use-after-free of struct cred.

In the Linux kernel, __do_adjtimex() did not check the return value of tk_get_aux_ts64. If the auxiliary clock is disabled during tk_get_aux_ts64() but enabled before tks->clock_valid is checked, uninitialized stack data is used in calculations and indirectly leaked to userspace.

A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.

A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary JavaScript in the victim's browser by injecting a crafted URL into the ca parameter.

Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects versions before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

Out-of-bounds read vulnerability in Citrix Workspace app for Windows. This issue affects versions before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission. A crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records.

AirSane versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion. The HttpServer::Request::content function reads the Content-Length header and passes it directly to std::string::resize() without upper-bound validation, causing allocation of gigabytes of memory and process crash. Additionally, non-numeric characters in the Content-Length header lead to undefined behavior.

GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php.

The nl.nl-portal:documenten-api package (through 3.0.0) and nl.nl-portal:besluiten package (1.5.0 through 3.0.0) lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users' document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch.

In versions up to and including 3.0.0, NL Portal Backend Libraries deployments using the shipped default configuration exposed two GraphQL developer features without authentication: the GraphiQL playground and schema introspection. Anyone able to reach the /graphiql endpoint could pull the full schema and use it to map out the API and craft calls against it. Version 3.0.1 patches the issue.

In multipathd, a local attacker with access to the multipathd UNIX control socket can send valid commands and then stop reading replies. This blocks the multipathd listener thread, leading to a Denial of Service (DoS) where legitimate IPC operations may hang or time out. The issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via unvalidated style values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers, with the compiled output written to the publicly served CSS cache.

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera.