CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the btrfs filesystem involves improper initialization of mapping flags and minimal folio order for cached inodes. Under specific conditions (e.g., 8K block size with 4K page size), this can lead to assertion failures and kernel panics.

In the Linux kernel, the sk_mc_loop() function triggers WARN_ON_ONCE(1) for sockets that are neither AF_INET nor AF_INET6, e.g., AF_PACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan. Non-INET sockets do not support IP_MULTICAST_LOOP or IPV6_MULTICAST_LOOP options, so loopback should default to true without generating a warning. The fix removes this warning.

In the Linux kernel, in the ata: pata_sl82c105 driver, there is a use-after-free when reading the bridge revision. pci_get_slot() returns a referenced PCI device, but after the change to direct access to the revision field, the read occurs after pci_dev_put(), which may lead to use of freed memory. The fix moves the revision read before dropping the reference.

A vulnerability was found in the Linux kernel's dev_validate_header() function in the networking stack. For processes with CAP_SYS_RAWIO capability, it zero-padded short link-layer headers by reading dev->hard_header_len directly. If the device was reconfigured and this value increased in the meantime, the zeroing write went beyond the allocated buffer, causing an out-of-bounds write.

In the Linux kernel, in the ring-buffer test, there is a bug causing a crash when passing ERR_PTR to kthread_stop(). The cleanup loop in test_ringbuffer() only checks for NULL values, not ERR_PTR, leading to dereferencing a bogus pointer and kernel panic during init test. The fix likely involves proper handling of ERR_PTR.

In the Linux kernel's mm/huge_memory, during folio split, the workingset state is not initialized, causing the xa_node to be unlinked from the shadow_nodes list. This can trigger VM_WARN_ON during memory reclaim.

In the Linux kernel, in the drm/amdgpu driver, a previous fix for aperture mapping leak was reverted. The previous fix caused a page fault in vcn_v4_0_sw_fini because devres teardown is LIFO and the aperture was unmapped before the DRM device release. The revert restores previous behavior.

In the Linux kernel's x86 MCE subsystem, there is an issue with timer initialization before CMCI discovery. During CMCI storm detection, the timer is modified before it is properly set up, leading to ODEBUG warnings and potential issues.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability details are available.

The Mendix SAML module in versions before V4.2.4 (for Mendix 10 and 11) and before V3.6.29 (for Mendix 9.24) does not properly validate the SAML response signature. In specific SSO configurations, this could allow unauthenticated remote attackers to hijack an account or session.

Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the product may change the other user's password.

An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may execute bootloader commands without authentication.

Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors.

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. Additionally, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, enabling path-traversal-capable file read/execute.

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `editAddress()` redirected non-owners away only when the loaded address row had a **non-empty** `user_id` belonging to someone else. Guest-checkout address rows have an empty `user_id`, so that check never triggered for them — any logged-in account guessing a small, sequential `address_id` got a guest customer's full name, street address, and phone number rendered prefilled into the edit form.

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml` grants the `carts` view's tasks a wildcard `true` ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. `J2StoreControllerCarts` already scoped `remove()` to the caller's own session, but never overrode the generic FOF `save` task, so it remained reachable to insert new cart rows with an attacker-chosen `user_id`/`session_id`, or overwrite an existing row by id.

Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check (`_validateIPN()`) accepted `UNVERIFIED` and any non-`INVALID` response as valid, made its verification request with `CURLOPT_SSL_VERIFYPEER` disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome. Separately, the paid-amount comparison only ran when `mc_gross` was a positive number; omitting the field from the POST body (`floatval(null) == 0`) skipped the check entirely. Combined with a merchant-configured `receiver_email` and a sequential, enumerable order id read from the `custom` field, an anonymous POST was enough to move a pending order straight to `CONFIRMED` with no payment, or force another customer's pending order to `FAILED`. `paypalv2.php` performed no amount check under any circumstances.