CVE Vulnerability Catalog

In the Linux kernel, kasan_populate_vmalloc() and its helpers ignored the caller's gfp_mask and always allocated memory using the hardcoded GFP_KERNEL flag. This made them inconsistent with vmalloc(), which supports GFP_NOFS and GFP_NOIO allocations, and xfs calls to vmalloc with GFP_NOFS could lead to a deadlock.

In the Linux kernel mm/damon/lru_sort module, hot_thres and cold_thres calculations use sample_interval or aggr_interval as divisors, which may lead to division-by-zero errors. The fix adds validation and returns -EINVAL when sample_interval is zero.

In the Linux kernel, the MTD rawnand stm32_fmc2 driver has an issue with overlapping DMA mappings of the ECC buffer, triggering a DMA-API warning about overlapping mappings. The vulnerability affects the STM32MP25 NAND controller and was fixed by using a contiguous non-cacheable buffer.

In the Linux kernel on arm64, the kexec_buf structure in load_other_segments() was declared without initialization. Commit bf454ec31add added a field that is always read but not consistently populated by all architectures, leading to use of uninitialized memory (garbage) and UBSAN warnings. The fix zero-initializes the structure at declaration.

A flaw in the Linux kernel's of_numa handling causes memory-only NUMA nodes (without CPUs) to be improperly initialized. This leads to a NULL pointer dereference in free_area_init() and a kernel panic during boot on affected configurations (e.g., ARM64 QEMU).

A vulnerability was fixed in the Linux kernel in the est_timer() function in net/core/gen_estimator.c, occurring when CONFIG_PREEMPT_RT=y is enabled. In real-time mode timer callbacks can be preempted, which triggered a warning in the seqlock mechanism. The fix uses preempt_disable_nested()/preempt_enable_nested().

In the Linux kernel, move_pages_pte() in mm/userfaultfd maps PTE pages using kmap_local_page() but unmaps them in the same order (dst_pte, src_pte), violating the required LIFO order when CONFIG_HIGHPTE is enabled on 32-bit ARM. This triggers a warning in kunmap_local_indexed().

In the Linux kernel, sched_numa_find_nth_cpu() uses a binary search to find the closest CPU in NUMA masks. If all CPUs in the mask are offline, the search returns NULL and the code dereferences a bogus pointer, causing a page fault and kernel panic during boot.

In the Linux kernel, the spi-qpic-snand driver fails to unregister the on-host hardware ECC engine when spi_register_controller() returns an error and on device removal. The fix unregisters the engine on the error path in qcom_spi_probe() and adds the missing call in qcom_spi_remove() to avoid use-after-free issues.

In the Linux kernel ASoC, snd_soc_lookup_component_nolocked() does not handle a NULL driver->name. When CPU and Platform share the same device (e.g., soc-generic-dmaengine-pcm.c), the missing driver name causes a NULL pointer dereference in strcmp during component unregistration.

The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handle HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments.

The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to and including 2.3.10 due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts.

The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.6.1 through publicly exposed log files. This allows unauthenticated attackers to view information like full paths and full paths to backup files contained in the exposed log files.

The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to and including 1.1.12 via the mcbSubmit_Form_Data() function. Unauthenticated attackers can make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.

An out-of-bounds read vulnerability in the OpenSSL HTTP client occurs when the 'no_proxy' environment variable is set and the host in the URL is an IPv6 address. This can cause a crash leading to Denial of Service (DoS).

A timing side-channel vulnerability in the SM2 algorithm implementation on 64-bit ARM platforms could allow remote recovery of the private key. This issue does not affect standard TLS configurations in OpenSSL but may be exploited in custom setups using SM2 certificates.

Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs. This vulnerability was fixed in Firefox for iOS 143.1.

The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'surveyanyplace_embed' shortcode in all versions up to and including 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooboigpost_shipping_status' shortcode in all versions up to and including 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts.