CVE Vulnerability Catalog

In the Linux kernel, drm/msm's msm_ioctl_gem_info_set_metadata() did not check for krealloc failure, potentially leading to null pointer dereference. The fix adds error checking and returns -ENOMEM, avoiding potential null pointer dereference.

In the Linux kernel, the ath10k wifi driver may lose PCIe bus connection in rare cases, leading to system crash during resume due to watchdog timeout. The fix sets a threshold for consecutive restart failures; if exceeded, hardware is considered unreliable and ath10k operations are skipped to avoid system crash.

In the Linux kernel, rcutorture's rcutorture_one_extend_check() caused a warning in RT kernels with CONFIG_PREEMPT_RT=y because disabling BH does not change SOFTIRQ bits in preempt_count(). The fix uses softirq_count() to check if BH is disabled.

In the Linux kernel RDMA hfi1 driver, find_hw_thread_mask() divides the number of online CPUs by num_core_siblings and only checks the divisor for zero afterwards. This can lead to a divide-by-zero runtime error.

In the Linux kernel's drm/xe/migrate driver, non-page-aligned copies can exceed the S16_MAX limit of the copy command, triggering an assertion. The fix accounts for the pitch when calculating the number of bytes to copy.

In the Linux kernel, a vulnerability was resolved in the iommu/arm-smmu-qcom driver due to missing support for the SM6115 MDSS compatible. Without this workaround, platforms based on SM4250/SM6115 (e.g., QRB4210 RB2) generate numerous SMMU context faults during boot and fail to initialize MDSS, GPU, and DPU components.

In the Linux kernel, kmemleak cleanup removes objects one by one in a workqueue loop, which with many objects (e.g. 40,000) and a slow debug kernel can trigger a soft lockup. The fix adds periodic cond_resched() calls in the loop.

In the Linux kernel mm/kmemleak, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock with the netconsole subsystem due to lock inversion. The fix sets a flag and issues pr_warn_once() after kmemleak_lock is released.

Under heavy system utilization, a random race condition can occur during authentication or token refresh. This may grant one user a token intended for another user, resulting in impersonation until the session ends.

In FoxCMS up to 1.24, the batchCope function in /app/admin/controller/Images.php allows manipulation of the ids argument, leading to SQL injection. The attack can be launched remotely and the exploit is publicly available.

The Online Fire Reporting System v1.2 by PHPGurukul contains a Stored XSS vulnerability in the endpoint '/ofrs/admin/edit-team.php'. Lack of validation of the 'tname' (GET) and 'teamleadname', 'teammember', 'teamname' (POST) parameters allows an attacker to inject a malicious script that can be stored and executed for an authenticated user.

DJI Mavic Spark, Mavic Air, and Mavic Mini (version 01.00.0500) contain a weakness in the telemetry channel involving the use of a hard-coded cryptographic key. The attacker must be present on the local network, and the attack complexity is high; the vulnerability only affects products no longer supported by the maintainer.

In OTP SSH (ssh_sftp modules) before certain versions, there is an uncontrolled resource consumption vulnerability leading to excessive allocation and flooding. The vulnerability is in the file lib/ssh/src/ssh_sftpd.erl.

The ssh_sftp module in Erlang OTP before OTP 28.0.3, 27.3.4.3, and 26.2.5.15 does not limit resource allocation, allowing excessive allocation and resource leak. The vulnerability is in lib/ssh/src/ssh_sftpd.erl.

The ssh_sftp module in Erlang OTP before OTP 28.0.3, 27.3.4.3, and 26.2.5.15 does not limit resource allocation, allowing excessive allocation and resource leak. The vulnerability is in lib/ssh/src/ssh_sftpd.erl.

The Evenium plugin for WordPress (all versions up to and including 1.3.11) is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. An authenticated attacker with contributor-level access and above can inject arbitrary web scripts into pages.

The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect nonce validation on the plugin_options function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Stored XSS vulnerability in Jobify plugin for WordPress (up to 1.4.4) via the 'keyword' parameter due to insufficient input sanitization and output escaping. Allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

A vulnerability was detected in JEPaaS 7.2.8 affecting the doFilterInternal function of the Filter Handler component, leading to improper access controls. The attack can be executed remotely and the exploit has been publicly disclosed; the vendor did not respond.

jsondiffpatch packages before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads are used as the diff source and the result is rendered with the built-in HTML formatter on a private website.