CVE Vulnerability Catalog

A flaw was found in the libsoup library in the append_param_quoted() function, which may cause a buffer overflow and under-read.

A memory leak was found in the Linux kernel's fib_check_nh_v6_gw() function for IPv6. The issue occurred after moving fib_nh_common_init() before pcpu memory allocation, leaving nhc_pcpu_rth_output uncleaned on allocation failure.

A vulnerability in the Linux kernel's netfs subsystem causes a call to the unimplemented `invalidate_cache` method on filesystems like NFS and Ceph. When writing to the cache (NETFS_WRITE_TO_CACHE) fails, the kernel dereferences a NULL pointer, leading to a crash (oops) and system hang.

A flaw in Tempo Operator where enabling Jaeger UI Monitor Tab creates a ClusterRoleBinding for the Tempo service account, granting cluster-monitoring-view role. A user with permissions to create TempoStack and read secrets in a namespace can read the service account token and access all cluster metrics.

A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions.

In the Linux kernel, a bug in btrfs zoned mode causes an extent range to remain locked in a specific scenario (no active zone and partial allocation). This leads to hung kernel tasks waiting on the extent lock.

In the Linux kernel's LLC (Logical Link Control) subsystem, a vulnerability was found where skb_get() is used before dev_queue_xmit(). This causes the network buffer (skb) to be shared, which, with drivers not supporting IFF_TX_SKB_SHARING (e.g., e1000), leads to a kernel BUG and system crash.

In the Linux kernel, a vulnerability in the amd_get_mmconfig_range() function for x86 has been fixed. Xen does not offer MSR_FAM10H_MMIO_CONF_BASE to all guests, causing an unchecked MSR access warning. The fix uses rdmsr_safe() instead of rdmsr() to safely handle the missing access.

A bug was fixed in the Linux kernel's memory-failure handling related to migration of poisoned folios. During unmapping of a poisoned folio, the TTU_HWPOISON flag was not set correctly, causing a kernel warning in try_to_unmap_one. The fix moves the flag-setting policy into unmap_poisoned_folio.

In the Linux kernel's enetc network driver, virtual functions (VFs) do not support HWTSTAMP_TX_ONESTEP_SYNC because only the PF can access PMa_SINGLE_STEP registers. Using a VF to test one-step timestamp causes a kernel crash (paging request error).

By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability was fixed in Firefox 137.

An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137.

JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.

A vulnerability exists in Apache ActiveMQ Artemis that allows a user with permissions to create queues to modify the routing type of an address, even if they do not have permission to create that address. This could lead to sending messages with a routing type not supported by the address.

An OS command injection vulnerability was found in the AI (Artificial Intelligence) module for Drupal. The flaw affects versions before 1.0.5 and allows an attacker to execute arbitrary commands on the server.

Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects CompletePBX: all versions up to and including 5.2.35.

The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges.

The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges.

In MISP before version 2.4.193, the menu_custom_right_link_html parameters can be set via the UI, allowing attackers with admin privileges to conduct XSS attacks on every page.