CVE Vulnerability Catalog

In the Linux kernel, the HID sensor custom driver has a use-after-free vulnerability in enable_sensor. Field attributes are created after exposing the enable_sensor sysfs attribute, and on removal enable_sensor is deleted after freeing the field attributes.

A use-after-free vulnerability was found in the Linux kernel's uclogic HID driver. The issue involves the inrange_timer which can be re-armed after cancellation during device removal, leading to a dereference of freed memory when the timer expires.

In the Linux kernel, the HID hyperv driver lacks bounds validation for initial device info. A malicious Hyper-V host or backend can send a short message with an oversized report descriptor length, leading to an out-of-bounds read past the VMBus packet.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_event). The hci_cc_reset() function clears the LE accept and resolving lists without holding hdev->lock, allowing a concurrent debugfs read to access freed memory. KASAN reported the issue as slab-use-after-free in white_list_show.

In the Linux kernel, the Bluetooth hci_event handler lacks validation of the LE Set CIG Parameters response. The function hci_cc_le_set_cig_params() trusts the num_handles value and reads entries from the array without checking that the response contains enough data.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync) during system suspend. The issue stems from improper synchronization of access to the accept list, potentially leading to a reference to freed memory.

In the Linux kernel, the Bluetooth ISO function iso_sock_getname() does not zero the sockaddr structure before returning it to user space, leaking uninitialized bytes from the kernel stack.

In the Linux kernel, the Bluetooth MGMT handler lacks an upper bound for params_len in HCI_CMD_SYNC. params_len can exceed 255, leading to a mismatch with the plen field in the HCI header and potentially causing the controller to interpret trailing bytes as the start of the next packet.

In the Linux kernel, the Bluetooth hci_aml driver's aml_download_firmware() function reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can cause the driver to read past firmware->data while constructing TCI commands. The fix rejects images shorter than the header and ensures that the ICCM and DCCM ranges fit within the loaded firmware.

In the Linux kernel, the futex mechanism has a use-after-free vulnerability in futex_private_hash_put(). This function drops the reference to fph before reading fph->mm for wake_up_var(). If that put drops the final reference and the task is preempted, another task can pivot to the replacement hash and free the old hash after an RCU grace period, and the first task reads from freed memory. The fix loads the mm pointer while the fph reference is still held and passes the saved value to wake_up_var().

In EMX Tecnologia Gestao X Business Suite version 8.4 and earlier, there is a reflected cross-site scripting (XSS) vulnerability. It is caused by insufficient validation and sanitization of the 'mensagem' parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser.

EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other authenticated users, potentially resulting in session hijacking, account takeover, and unauthorized actions.

JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.

IBM UCD - IBM UrbanCode Deploy versions 7.2 through 7.2.3.25 and 7.3 through 7.3.2.20, and IBM UCD - IBM DevOps Deploy versions 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7, contain a vulnerability that allows a remote denial of service due to an infinite loop. A remote attacker can exploit this flaw to overload the system and prevent normal operation.

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication, allowing a remote attacker to execute arbitrary code.

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer.

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.

A cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter.